topic Hi,I think as the SSH is to in Network Security

Simple firewall implementation

deboeredwin — Tue, 12 Mar 2019 05:03:55 GMT

Hello,

I'm pretty new to the cisco product and want to setup a simple firewall.

I found some exampels but can't get it to work.

For now we are using Cisco routers 88x and 89x series.

When I activate te script I the remote connection to the router is lost, although I have put an permit rule for ssh.

The script is the following:

ip inspect name Firewall tcp
ip inspect name Firewall udp
ip inspect name Firewall rtsp
ip inspect name Firewall h323
ip inspect name Firewall netshow
ip inspect name Firewall ftp
ip inspect name Firewall ssh
!
ip access-list extended Allow-IN
permit eigrp any any
permit icmp any 192.168.2.0 0.0.0.255 echo-reply
permit icmp any 192.168.2.0 0.0.0.255 unreachable
permit icmp any 192.168.2.0 0.0.0.255 administratively-prohibited
permit icmp any 192.168.2.0 0.0.0.255 packet-too-big
permit icmp any 192.168.2.0 0.0.0.255 echo
permit icmp any 192.168.2.0 0.0.0.255 time-exceeded
permit tcp any 192.168.2.0 0.0.0.255 eq 22
deny ip any any
!
interface Vlan1
ip inspect Firewall in
!
interface Dialer1
ip access-group Allow-IN in
!

Can anyone tell me what I'm doing wrong here?

And a second question, can I use for the ip inspect also port numbers or must I always use a service name?

Thank you,

//Edwin

Hi,I think as the SSH is to

Vibhor Amrodia — Wed, 12 Nov 2014 10:22:19 GMT

Hi,

I think as the SSH is to the router itself , you would need the "router-traffic" keyword.

For your 2nd Query , this will help:-

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-i2.html#wp2665953023

Thanks and Regards,

Vibhor Amrodia

Hello, I have tested this.I

deboeredwin — Wed, 12 Nov 2014 13:59:12 GMT

Hello,

I have tested this.

I couldn't add the router-traffic to the ip inspect rule for ssh but could add it to the ip inspect rule with tcp.

I tested this option but unfortunatly the connection was closed again as soon the rules were applied to the interfaces.

Maybe I did it wrong or it doesn't work.

//Edwin