outbound traffic

[khaledeshah]

Hi
I have a PIX 515 with 6 interfaces, I put the servers in one of them, and I make access-lists to them to let outside users access
Now I need to know can I make access-lists to these servers to let them access only certain ports to the ouside (outbound traffic) eg how can I make to smtp - dns servers ?

 

[yizhar]

HI.

Yes. You can apply an access-list to the DMZ interface where the servers are connected. This will disable the default implicit outbound rule and will allow only traffic that is specified in the ACL . Remember that access-list have an implicit "deny any any" at the end.
For DNS traffic - open both TCP and UDP port 53.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar