Solved

cisco router - ip insepct interface

Posted on 2013-01-24
2
369 Views
Last Modified: 2013-01-25
I am trying to determine if it matters which interface I apply the "ip inspect" too on a cisco ios router/firewall.  

From reading up on the "ip inspect" it says that if you have the "ip inspect" the return traffic will bypass any ACLs.    In the below example will the return traffic still bypass the ACL 100 on Fa0/1 even if the inspect is applied to Fa0/0.

internal network: 192.168.1.0/24

interface FastEthernet0/0
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 ip access-group 101 in
 ip inspect FWINSPECT in
 ip nat inside

interface FastEthernet0/1
 description Connection to the Internet
 ip address 1.1.1.2 255.255.255.252
 ip access-group 100 in
 ip nat outside


Thanks
0
Comment
Question by:tiptechs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 20

Expert Comment

by:rauenpc
ID: 38815263
I believe it will work regardless of interface, but if you only have one inspection policy, I would put it on the outside interface so that any other inside interfaces, whether existing today or configured in the future, all end up getting covered by that policy.
0
 
LVL 15

Accepted Solution

by:
Frabble earned 500 total points
ID: 38816382
Where you do the inspection depends on the router/firewall topology. To say that return traffic bypasses ACLs is incorrect. CBAC dynamically modifies ACLs to allow the flow of return traffic and data channnels in FTP for example.

If you regard the router interfaces as internal and external, "inspect in" the internal or  "inspect out" the external would modify the incoming access list on the external interface and outgoing list on the internal interface.

In the example above, the inspect in on internal Fa0/0 will modify the acl 100 in on external Fa0/1 to allow the return traffic.

There is all the detail here:
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdcbac.html
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question