?
Solved

cisco router - ip insepct interface

Posted on 2013-01-24
2
Medium Priority
?
372 Views
Last Modified: 2013-01-25
I am trying to determine if it matters which interface I apply the "ip inspect" too on a cisco ios router/firewall.  

From reading up on the "ip inspect" it says that if you have the "ip inspect" the return traffic will bypass any ACLs.    In the below example will the return traffic still bypass the ACL 100 on Fa0/1 even if the inspect is applied to Fa0/0.

internal network: 192.168.1.0/24

interface FastEthernet0/0
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 ip access-group 101 in
 ip inspect FWINSPECT in
 ip nat inside

interface FastEthernet0/1
 description Connection to the Internet
 ip address 1.1.1.2 255.255.255.252
 ip access-group 100 in
 ip nat outside


Thanks
0
Comment
Question by:tiptechs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 20

Expert Comment

by:rauenpc
ID: 38815263
I believe it will work regardless of interface, but if you only have one inspection policy, I would put it on the outside interface so that any other inside interfaces, whether existing today or configured in the future, all end up getting covered by that policy.
0
 
LVL 15

Accepted Solution

by:
Frabble earned 2000 total points
ID: 38816382
Where you do the inspection depends on the router/firewall topology. To say that return traffic bypasses ACLs is incorrect. CBAC dynamically modifies ACLs to allow the flow of return traffic and data channnels in FTP for example.

If you regard the router interfaces as internal and external, "inspect in" the internal or  "inspect out" the external would modify the incoming access list on the external interface and outgoing list on the internal interface.

In the example above, the inspect in on internal Fa0/0 will modify the acl 100 in on external Fa0/1 to allow the return traffic.

There is all the detail here:
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdcbac.html
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
Suggested Courses

718 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question