Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow a host to download some updates from * (in internet).

How should I permit only this host from my inside network to access * on ASA, access can be via http?

At moment I have no any NAT and I want to implement it via ASDM.

share|improve this question

Assuming that at this moment, all inside hosts have permission to access all external hosts on any port, you need to add two rules:

  1. allow access from the inside host to the external host (not a domain) on port 80.
  2. deny access from the inside to that external host.

If that assumption is not correct, you need to provide more useful information.

EDIT: I see you added the fact that there is no global NAT pool almost as an afterthought - so does this mean there is currently NO NAT configured from inside to outside, for this inside host ?

If that is the case, you need to configure it; the easiest way is to add a static policy NAT from the internal host to the external host, on port 80; you can use the ASA interface as the translated source address.

This would obviate the need for the access rules above.

share|improve this answer
There is no NAT but as you said I need a NAT for inside to outside interfaces.In this case I need a permit ACL for only one Domain Name as destination (the destination can have dynamic or different IPs). – Ali A Apr 3 '12 at 7:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.