Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

cisco router - ip insepct interface

Posted on 2013-01-24
2
Medium Priority
?
373 Views
Last Modified: 2013-01-25
I am trying to determine if it matters which interface I apply the "ip inspect" too on a cisco ios router/firewall.  

From reading up on the "ip inspect" it says that if you have the "ip inspect" the return traffic will bypass any ACLs.    In the below example will the return traffic still bypass the ACL 100 on Fa0/1 even if the inspect is applied to Fa0/0.

internal network: 192.168.1.0/24

interface FastEthernet0/0
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 ip access-group 101 in
 ip inspect FWINSPECT in
 ip nat inside

interface FastEthernet0/1
 description Connection to the Internet
 ip address 1.1.1.2 255.255.255.252
 ip access-group 100 in
 ip nat outside


Thanks
0
Comment
Question by:tiptechs
2 Comments
 
LVL 20

Expert Comment

by:rauenpc
ID: 38815263
I believe it will work regardless of interface, but if you only have one inspection policy, I would put it on the outside interface so that any other inside interfaces, whether existing today or configured in the future, all end up getting covered by that policy.
0
 
LVL 15

Accepted Solution

by:
Frabble earned 2000 total points
ID: 38816382
Where you do the inspection depends on the router/firewall topology. To say that return traffic bypasses ACLs is incorrect. CBAC dynamically modifies ACLs to allow the flow of return traffic and data channnels in FTP for example.

If you regard the router interfaces as internal and external, "inspect in" the internal or  "inspect out" the external would modify the incoming access list on the external interface and outgoing list on the internal interface.

In the example above, the inspect in on internal Fa0/0 will modify the acl 100 in on external Fa0/1 to allow the return traffic.

There is all the detail here:
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdcbac.html
0

Featured Post

Lessons on Wi-Fi & Recommendations on KRACK

Simplicity and security can be a difficult  balance for any business to tackle. Join us on December 6th for a look at your company's biggest security gap. We will also address the most recent attack, "KRACK" and provide recommendations on how to secure your Wi-Fi network today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
In this article, WatchGuard's Director of Security Strategy and Research Teri Radichel, takes a look at insider threats, the risk they can pose to your organization, and the best ways to defend against them.
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question