why my external DMZ can always connect to Internet then i want not the DMZ has access to Internet and sub network(Informatique and Administration). What's wrong in my config.

  • I'm not certain I understand what you are trying to do. Can you explain it again? – Ron Trunk Jul 3 '16 at 21:37
  • Ok i have an external DMZ which connect to Internet and i want to deny this connection. I tried some ACL but it blocks all traffic instead the only i want. – google Jul 3 '16 at 22:22

I'm going to try again, now that I think I understand your requirements better.
I think you want to allow inbound connections to the DMZ, but deny outbound connections from the DMZ

ip access-list extended Deny-Outbound
permit tcp any any established
permit icmp any any echo-reply

interface fa 0/0
ip access-group Deny-Outbound in

If this isn't what you want, please help me understand better.

| improve this answer | |
  • Thanks you very much it work. So i have a question about these 2 words established and echo-reply, they are keywords or just a name you take ? I'm not yet familiar with the ACL. – google Jul 4 '16 at 1:43
  • They are keywords. "Established" only permits tcp packets with the ACK flag set. A new connection doesn't have that flag set, so it will be blocked. "Echo-reply" only allows responses to pings (echo-request). So you can ping the DMZ, but the DMZ can't ping out. – Ron Trunk Jul 4 '16 at 1:47
  • I forget to ask you something about Radius Server, is it possible to block that server for some user of sub network ? I tried one like this but it doesn't work: access-list 101 deny udp eq 1645 – google Jul 4 '16 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.