Blocked AIM, but there are side effects

[Tekmazter]

First, I'm using a PIX 515E. I didn't see a PIX forum on here, so I'm trying the next closest thing.

Here we go: There seems to be many IP Addresses that AIM uses to login so I blocked a range of IP Addresses in my rules:

(64.12.0.0)
+
(205.188.0.0)

along with port 5190 on a separate rule from any 'inside' to any 'outside'.

This does seem to work in denying AIM functionality on my network. However, it also blocks AOL.com and any ability to check AOL e-mail. My question is, how can I create a more specific rule entry without having to create a separate rule for every single IP that correlates to login.oscar.aol.com? I'm new to PIX so I've been using the GUI so far to do this. Is there any way to specify hostnames instead of an IP so I could just create one rule for say login.oscar.aol.com?

 

[Dimpa1]

To block aim you will have to know all the addresses to the servers for aim login and be more specific on access-list. BTW, smart users will be able to change the default port aim uses and still be able to get out. IE. change port 5190 to 80 and it will work since 80 is used for

http://www =D

Use a third party software to block access to it. I dont know of a particular software, but I know they are out there.

"Unemployed

 

[Tekmazter]

Yea, I ended up getting a little more creative and did the following:

While I blocked the service port 5190 entirely, I've also FULLY blocked the entire AOL network ranges in the 64.12 and 205.188 area's. However, on the flip side, I didn't want to block user access to sites such as Mapquest.com so I got one of its IP's and created a host record for it in my DNS to force the IP mapquest goes to from my network. Then I created a separate rule on the PIX to say that Mapquest.com is allowed to the same exact IP and everything appears to be working the way I want it to. Should in the future find sites that are blocked but should be allowed, I would just add those sites to my PIX access-list. Consequently I have created a network group for this purpose called 'AOLGranted' to avoid 300 rules as time goes on.