topic Problem when setting firewall on AS5350XM in Network Security

Problem when setting firewall on AS5350XM

mitkin2891 — Mon, 11 Mar 2019 21:25:32 GMT

Hi,

I'm trying to configure an extended access list on one AS5350XM but I get one way hearing on a voice calls and I can't determine why (please see the attached diagram). There is an OSPF running on both gigabit interfaces and the Loopback address is also advertised (it is actually the voip IP address). The access list is applied on both interfaces in the inbound direction. There is another gateway with IP:4.4.4.4 (no firewalls here) and the routing between gateways is working properly.

Here is part of the access list (applied on AS5350):

permit ip host 4.4.4.4 host 3.3.3.3

When I review the log of the AS5350xm I see many errors like this one:

%SEC-6-IPACCESSLOGP: list example denied udp 3.3.3.3(16638) -> 4.4.4.4(18094), 1 packet

So how it is possible to see this error since the access list is in inbound direction and the IP address (4.4.4.4) is open. I don't have problems when I do telnet or ssh from 3.3.3.3 to 4.4.4.4.

Thanks

Problem when setting firewall on AS5350XM

Parminder Sian — Mon, 19 Sep 2011 04:20:59 GMT

Hey,

Have you tried disabling inspections for voice if any, also have a look at this link :-

http://www.cisco.com/en/US/customer/tech/tk652/tk698/technologies_tech_note09186a008009484b.shtml

Regards,

Sian

Problem when setting firewall on AS5350XM

mitkin2891 — Mon, 19 Sep 2011 21:20:30 GMT

Hey Sian,

Thank you for your reply. Everything works ok regarding the voice part. The one way voice issue only appears when I apply the access list in the inbound direction on both interfaces. I see the problem but I don't understand why it happens.

%SEC-6-IPACCESSLOGP: list example denied udp 3.3.3.3(16638) -> 4.4.4.4(18094), 1 packet

The loopback interface is with IP 3.3.3.3 and it is not normal to see an inbound packet coming to the router with this source IP (if it is not spoofed of course) expecially going to the 4.4.4.4 which is obviously in the other direction. It looks like that I applied the ACL into the out direction but I didn't.

Any other ideas?

Thanks

Problem when setting firewall on AS5350XM

mitkin2891 — Thu, 22 Sep 2011 14:05:39 GMT

Any other ideas? I will appreciate any help on this matter.

Thank you.