topic ip inspect name -Router interface does not gets ip from ISP in Network Security

ip inspect name -Router interface does not gets ip from ISP

mahesh18 — Tue, 12 Mar 2019 01:36:09 GMT

Hi all,

My router interface gets ip from ISP modem.

router interface has command

ip address dhcp.

I applied ACL to deny all incoming traffic to router interface fa0/0 which connects to ISP

I have applied CBAC on router and currently allow this traffic to go outside

ip inspect name REMEMBER tcp

ip inspect name REMEMBER udp

ip inspect name REMEMBER icmp

ip inspect name REMEMBER dns

ip inspect name REMEMBER ntp

ip inspect name REMEMBER bootps

ip inspect name REMEMBER bootpc

Need to know what inspect i should allow so that router can get ip,dns,gateway address from ISP?

if i need to access the http or https websites do i need to add the inspect http or https?

also am i missing something under inspection to allow from inside?

Thanks

Mahesh

Message was edited by: mahesh parmar

ip inspect name -Router interface does not gets ip from ISP

cadet alain — Mon, 29 Apr 2013 08:17:11 GMT

Hi,

add this to your config because by default CBAC won't inspect traffic generated by the router.

ip inspect name REMEMBER dns router-traffic

ip inspect name REMEMBER ntp router-traffic

ip inspect name REMEMBER bootps router-traffic

ip inspect name REMEMBER bootpc router-traffic

Regards

Alain

Don't forget to rate helpful posts.

ip inspect name -Router interface does not gets ip from ISP

mahesh18 — Mon, 29 Apr 2013 18:51:27 GMT

Hi Alain,

I will test this today and will update you.

Regards

Mahesh

Re: ip inspect name -Router interface does not gets ip from ISP

mahesh18 — Tue, 30 Apr 2013 00:37:34 GMT

Hi Alain,

Seems my router has no option for router traffic

ip inspect name REMEMBER bootpc ?

alert Turn on/off alert

audit-trail Turn on/off audit trail

timeout Specify the inactivity timeout time

But i applied ACL on inside to allow

permit udp any any eq bootpc

that fixed the issue.

Many thanks for answering the questions and letting me know about router traffic option.

Regards

MAhesh

ip inspect name -Router interface does not gets ip from ISP

cadet alain — Tue, 30 Apr 2013 07:08:05 GMT

Hi,

don't forget the DNS and the NTP traffic too as you mentioned in your first post.

theree's also a router trick to make the CBAC take into account this router generated traffic: make it a transit traffic by sending it to a loopback interface with a local PBR.

Regards

Alain

Don't forget to rate helpful posts.