Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to block GotoMyPC traffic using a Cisco ASA 5505.

On they say you can block all traffic to to stop all access.

What I have done is create a network group that contains the objects that referencethe IPs for and (with being a host name/a record the IP could change - is there a way to reference the host name with the ASA instead of an IP?)

I set outside access rules from the source gotomypcgroup and blocked all traffic trying the following services: IP, TCP, UDP. however I am still able to connect using gotomypc.

If I create an inside rule it automatically create a rull to block all traffic from any - any that I can not edit, stopping all network traffic.

I used our dns proxy to block all traffic to and, but I can not get the traffic blocked from the ASA itself. I also know the ASA has regex's for gotomypc but I am unsure how to use them.

Trying to figure out what I am doing wrong


share|improve this question
up vote 3 down vote accepted

When you create your first explicit rule on an interface, the implicit rule for the interface changes from "allow all traffic bound for a lower-security interface" to "deny any".

Assuming that your inside interface is your highest security interface, all you need to do to get back to your firewall's current behavior is add an "allow ip any any" under your "deny gotomypc" rule.

share|improve this answer
right now on the inside interface there are 2 rules. any-anyless secure networks-ip-permit and any-any-ip-deny. We do have 3 remote locations that are connected using site-to-site vpn. will this break the site-to-site vpn with the remote locations? – Jeff Dec 9 '11 at 16:45
@Jeff Yeah, that's correct for the ACL; that's the default configuration when there's no actual access list applied to the interface. Nope, IPSec tunnels should not be affected. – Shane Madden Dec 9 '11 at 16:48
the inside interface now has 3 incoming rules. source-destination-server-action is as follows: , any-any-ip-permit, any-any-ip-deny(non-editable). before I hit apply (middle of workday..) does this look correct? thanks. – Jeff Dec 9 '11 at 16:52
@Jeff Maybe wait until people are at lunch ;) But yeah, that looks good. – Shane Madden Dec 9 '11 at 16:55
Thanks for your help. – Jeff Dec 9 '11 at 18:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.