I have set up the following network:
My goal is to allow connections to be initiated from the computer on the right (Host 2) to the computer on the left (Host 1). I also want Host 1 to be unable to initiate connections. Finally, I want Host 1 to be unable to send inbound traffic.
Very simple ACL's:
access-list 101 line 1 extended permit tcp any any access-list 101 line 2 extended deny ip any any access-list 102 line 1 extended deny ip any any
- ACL 101 - applied to inbound traffic of the right side of the ASA
- ACL 102 - applied to inbound traffic of the left side of the ASA
Using NetCat, I was able to forge a connection from Host 2 to Host 1 with no problem and am denied, as intended, from initiating the connection from Host 1 to Host 2:
As you can see, sending it from the Host 2 (white screen) to Host 1 (black screen) creates the FW flag UO (TCP handshake completed and outbound traffic). Now, When I send traffic from the black terminal to the white terminal, it changes the FW flag to "UIO" (outbound and inbound traffic).
What I want is to block incoming traffic from Host 1 while keeping the connection established and allowing outbound traffic. How can I accomplish this?