Basic ASA5505 Setup Question

Question

I have a new 5505 installed to a pretty small network.  I have the outside IP/mask/gateway from the provider, and I can see the other end or that connection as well as ping devices out on the internet from the console.
What's a good rule of thumb for my inside network to access the internet knowing I only need 80 and 443 open?  Meaning can someone provide an ACL example that will do just that?
I'm guessing the following may be a little TOO open:
access-list outside_access_in extended permit tcp any eq www any eq www
access-list outside_access_in extended permit tcp any eq https any eq https
Thank you.

Answer 1

Hi,
ok I understood but you also need to permit DNS and ICMP.
For ICMP just enable inspection like this:
policy-map global_policy
class inspection_default
inspect icmp
For other traffic, you can configure an ACL only permitting return traffic and apply inbound on interface outside or configure an ACL only permitting exiting traffic and apply on interface inside inbound.In this case you'll have to permit icmp if you want it to be inspected.
In latter case your ACL should be like this:
access-list outside_access_out extended permit tcp  x.x.x.x.x y.y.y.y any eq www
access-list outside_access_out extended permit tcp  x.x.x.x y.y.y.y any eq https
access-list outside_access_out extended permit udp  x.x.x.x y.y.y.y any eq dns
access-list outside_access_out extended permit icmp any any
access-group outside_access_out in interface inside
And enable icmp inspection like above.
Regards.
Alain