First, a couple things to be aware of on the ASA: 1) All inbound traffic (from unprotected --> protected network) is Denied by default. You must explicitly permit the traffic you want via an interface ACL.
2) All outbound traffic (from protected network --> unprotected network) is Permitted by default 3) Security levels determine what is the protected vs. unprotected network. So, assuming you are permitting those ports in access-list outside-in (via a more broad ACE), then you can explicitly deny them by entering the following: access-list outside-in deny tcp any any eq 135 access-list outside-in deny ucp any any eq 135 [repeat for the other port numbers]. Note: these new ACEs would need to be placed 'above' any existing rules which 'permit' traffic to those ports, as the access-list is evaluated based on first match in the rule table. Finally, I highly suggest upgrading the software to a more recent release. 7.2.3 is extremely old. Sincerely, David. On 2/11/2015 3:26 AM, [email protected] wrote: > I would like to block the following ports: 135,137,138,139,445,593,4444 > tcp/udp on my Firewall > > interface GigabitEthernet0/0 > nameif outside > security-level 0 > ip address 10.16.0.4 255.255.255.0 standby 10.16.0.5 > ! > interface GigabitEthernet0/1 > nameif inside > security-level 100 > ip address 10.6.80.5 255.255.255.0 standby 10.6.80.6 > ! > > access-group outside-in in interface outside > route outside 10.1.0.0 255.255.0.0 10.16.0.250 1 > route outside 10.1.0.0 255.255.0.0 10.16.1.250 10 > > WAN-ASA# sh ver > > Cisco Adaptive Security Appliance Software Version 7.2(3) Device Manager > Version 5.2(3) > > Regards, > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
