[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Cisco 2811 router and opening ports 80 and 443

Posted on 2006-11-03
3
Medium Priority
?
2,156 Views
Last Modified: 2012-08-13
Hi all
I am running server 2003 domain ent edition wiath AD,DNS,DHCP servers.  I am in the process of installaing sophos appliance WS 1000 for web cache (http traffic filtering) and malware filtereing for my domain.  The applicance has two ports at the back one LAN and one WAN.  Under the configuration of the appliance I have to firewall cisco 2811 to accept port 80 and 443 only from this appliance:
Questions:
-120 permit tcp any host 64.xx.xxx.xxx eq www does this command opens up port 80 on this firewall for this appliance of sophos ?
-120 permit tcp any host 64.xx.xxx.xxx eq 443 opens up 443 on this appliance?
If yes
there are other servers on my domain which have ports:
-120 permit tcp any host 64.xx.xxx.xxx eq www opened should I close it?
-120 permit tcp any host 64.xx.xxx.xxx eq 443 (this is excahnge server) do I have to close it?
Configuration:
Other configuration I am thinking of is to make this router the default gateway of my servers which are default gateway for http traffic of my clients.  So that all http traffic has to pass through this appliance.  Is it a good set up to think off?
Help plz
AM


0
Comment
Question by:amanzoor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 1

Accepted Solution

by:
ex-engineer earned 1600 total points
ID: 17866514
AM:

You're on the right track. You have to know the correct syntax for creating extended access-lists. You can very easily go to the Cisco website to get that.

It should look something like this:

ip access-list extended PERMIT_SOPHOS
permit <source address> <source mask> <destination address> <destination mask> eq <tcp port number or application keyword>

You get the picture. Remember that there is an implicit "deny all/deny any" at the end of each access list, so make sure you have statements for ALL traffic you want permitted and then the implicit (invisible) "deny all" statement at the end of the access list will block everything else.
0
 
LVL 1

Expert Comment

by:ex-engineer
ID: 17866577
Note: When i say destination or soucre mask, I am talkign about a wildcard mask. And also, after the permit keyword, you can specify the general protocol (IP, TCP, UDP, ICMP, etc).

Go to Cisco's website.

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d1d4.html#wp1078593
0
 
LVL 4

Assisted Solution

by:neoponder
neoponder earned 400 total points
ID: 17868045
just make sure you apply it on the right interface in the right direction.

i.e. you want it on the inbound side of the external interface...

ip access-group 120 in
0

Featured Post

Q2 2017 - Latest Malware & Internet Attacks

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out our latest Quarterly Internet Security Report!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
This program is used to assist in finding and resolving common problems with wireless connections.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question