Cisco cbac ios firewall 2811

amanzoor
amanzoor used Ask the Experts™
on
Hi,
What is the command to allow an external IP (v.v.v.v) which belongs to my ISP to pass through my access list 101.  Infact I do not want any of my inbound or outbound rules to check the traffic from this external ip address?  
Help
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Istvan KalmarHead of IT Security Division
Top Expert 2010

Commented:
please show the config
amanzoorNetwork infrastructure Admin

Author

Commented:
ikalmar:
Attached.
expertaccesslist.txt
Head of IT Security Division
Top Expert 2010
Commented:
Hi,

you need:

ip access-list extended 101
 5 permit ip host v.v.v.v host x.x.x.x


Should you be charging more for IT Services?

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Top Expert 2004

Commented:
Anything you permit in your inbound access list will not be inspected.
amanzoorNetwork infrastructure Admin

Author

Commented:
ikalmar:
THanks

mikebernhardt:
I have access list 101 only, this is exactly what I want 'Anything you permit in your inbound access list will not be inspected".............Is my 101 also checking the inbound?
Top Expert 2004
Commented:
How it works is when you inspect outbound traffic, temporary permit statements are added to the inbound list to permit return traffic. So if you have a permit statement in list 101, that traffic will be permitted no matter what. I'm not actually sure whether it's inspected or not, but it is permitted anyway since you've explicitly allowed it.
Top Expert 2004

Commented:
Just for your edification, if you "show access-list 101" while you have inspected traffic running through that interface, you will see that the list has additional entries that you didn't put there. They will come and go as the router times out dead sessions.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial