Solved

cisco router - ip insepct interface

Posted on 2013-01-24
2
364 Views
Last Modified: 2013-01-25
I am trying to determine if it matters which interface I apply the "ip inspect" too on a cisco ios router/firewall.  

From reading up on the "ip inspect" it says that if you have the "ip inspect" the return traffic will bypass any ACLs.    In the below example will the return traffic still bypass the ACL 100 on Fa0/1 even if the inspect is applied to Fa0/0.

internal network: 192.168.1.0/24

interface FastEthernet0/0
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 ip access-group 101 in
 ip inspect FWINSPECT in
 ip nat inside

interface FastEthernet0/1
 description Connection to the Internet
 ip address 1.1.1.2 255.255.255.252
 ip access-group 100 in
 ip nat outside


Thanks
0
Comment
Question by:tiptechs
2 Comments
 
LVL 20

Expert Comment

by:rauenpc
ID: 38815263
I believe it will work regardless of interface, but if you only have one inspection policy, I would put it on the outside interface so that any other inside interfaces, whether existing today or configured in the future, all end up getting covered by that policy.
0
 
LVL 15

Accepted Solution

by:
Frabble earned 500 total points
ID: 38816382
Where you do the inspection depends on the router/firewall topology. To say that return traffic bypasses ACLs is incorrect. CBAC dynamically modifies ACLs to allow the flow of return traffic and data channnels in FTP for example.

If you regard the router interfaces as internal and external, "inspect in" the internal or  "inspect out" the external would modify the incoming access list on the external interface and outgoing list on the internal interface.

In the example above, the inspect in on internal Fa0/0 will modify the acl 100 in on external Fa0/1 to allow the return traffic.

There is all the detail here:
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdcbac.html
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Occasionally, we encounter connectivity issues that appear to be isolated to cable internet service.  The issues we typically encountered were reset errors within Internet Explorer when accessing web sites or continually dropped or failing VPN conne…
I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now