| 10.2 |  | Using ACLs |
| 10.2.1 |  | Denying web access to the Internet |

| There are a number of reasons why an administrator might enable an ACL on a PIX Security Appliance Interface. This section looks at a variety of examples and explains how to use ACLs in each instance. Denying web access to the Internet One possibility in which an administrator might wish to restrict traffic is denying Web access to users on the internal network. Many companies have policies that do not allow their employees to access the Internet. However, by default the PIX Security Appliance allows this type of traffic to pass, because it originates from a higher security interface. In order to restrict this access, the administrator would need to create an ACL and apply it to an interface on the PIX Security Appliance. Typically, it would be applied to the inside network interface, because applying an ACL to the inside interface restricts internal users from establishing outside connections.

In Figure , the ACL named acl_out is applied to traffic inbound to the inside interface. The ACL acl_out denies Hypertext Transfer Protocol (HTTP) connections from an internal network, but it lets all other IP traffic through. By adding additional lines to the access list, it is possible to create exceptions for particular users to access the Web, while continuing to restrict the others.