Solved

cisco router - ip insepct interface

Posted on 2013-01-24
2
361 Views
Last Modified: 2013-01-25
I am trying to determine if it matters which interface I apply the "ip inspect" too on a cisco ios router/firewall.  

From reading up on the "ip inspect" it says that if you have the "ip inspect" the return traffic will bypass any ACLs.    In the below example will the return traffic still bypass the ACL 100 on Fa0/1 even if the inspect is applied to Fa0/0.

internal network: 192.168.1.0/24

interface FastEthernet0/0
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 ip access-group 101 in
 ip inspect FWINSPECT in
 ip nat inside

interface FastEthernet0/1
 description Connection to the Internet
 ip address 1.1.1.2 255.255.255.252
 ip access-group 100 in
 ip nat outside


Thanks
0
Comment
Question by:tiptechs
2 Comments
 
LVL 20

Expert Comment

by:rauenpc
ID: 38815263
I believe it will work regardless of interface, but if you only have one inspection policy, I would put it on the outside interface so that any other inside interfaces, whether existing today or configured in the future, all end up getting covered by that policy.
0
 
LVL 15

Accepted Solution

by:
Frabble earned 500 total points
ID: 38816382
Where you do the inspection depends on the router/firewall topology. To say that return traffic bypasses ACLs is incorrect. CBAC dynamically modifies ACLs to allow the flow of return traffic and data channnels in FTP for example.

If you regard the router interfaces as internal and external, "inspect in" the internal or  "inspect out" the external would modify the incoming access list on the external interface and outgoing list on the internal interface.

In the example above, the inspect in on internal Fa0/0 will modify the acl 100 in on external Fa0/1 to allow the return traffic.

There is all the detail here:
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdcbac.html
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now