[lesky]

Hi all,

How do I configure Cisco ASA 5505 (using ASDM 5.2) to block a workstation (IP address) from accessing internet completely? I was trying to set up a new incoming access rule for outside interface to deny any IP traffic to that workstation but it doesn't work from some reason - the workstation can still access the internet. The ASA has no special settings, only a few ports opened for servers (see attached screenshot).

Thanks.

[zx10guy]

I don't think that rule is working because the return traffic from the internet is going to have a destination IP address of your public IP you're using to NAT your internal IPs (assuming you're using a NAT overload.) I think you'll have to do it from the inside interface and it's usually best practices to put ACL restrictions closests to the host traffic you're trying to regulate. The reason is you cut down on unnecessary processing of return traffic which wouldn't normally need to be processed.