1

I want to allow a host to download some updates from *.xyz.com (in internet).

How should I permit only this host from my inside network to access *.xyz.com on ASA, access can be via http?

At moment I have no any NAT and I want to implement it via ASDM.

1 Answer 1

0

Assuming that at this moment, all inside hosts have permission to access all external hosts on any port, you need to add two rules:

  1. allow access from the inside host to the external host (not a domain) on port 80.
  2. deny access from the inside to that external host.

If that assumption is not correct, you need to provide more useful information.

EDIT: I see you added the fact that there is no global NAT pool almost as an afterthought - so does this mean there is currently NO NAT configured from inside to outside, for this inside host ?

If that is the case, you need to configure it; the easiest way is to add a static policy NAT from the internal host to the external host, on port 80; you can use the ASA interface as the translated source address.

This would obviate the need for the access rules above.

1
  • There is no NAT but as you said I need a NAT for inside to outside interfaces.In this case I need a permit ACL for only one Domain Name as destination (the destination can have dynamic or different IPs).
    – Ali A
    Apr 3, 2012 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .