topic Re: Incoming Access List blocking Outgoing Internet Access on 87 in Network Security

Incoming Access List blocking Outgoing Internet Access on 877W

shaw.chris — Mon, 11 Mar 2019 14:08:06 GMT

Hi,

I have set up my 877w with the following config, I wanted to block incoming access to the ATM0.1 interface so created the "OUTSIDEIN" access list.

I also created the INSPECTOUT list for outgoing packet inspection (which I believed would bypass the incoming access list restriction)

When I apply the OUTSIDEIN access list to my ATM 0.1 interface internet access stops for my clients.

Any idea why this could be? or any debugs I could use to find out why?

Many Thanks, Chris

version 12.4

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname router

boot-start-marker

boot-end-marker

logging message-counter syslog

no logging buffered

no aaa new-model

clock timezone gmt 0

clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 2:00

dot11 syslog

dot11 ssid wirelessnet

authentication open

authentication key-management wpa

guest-mode

wpa-psk ascii 0 xxxxxxxx

ip source-route

no ip dhcp use vrf connected

ip dhcp excluded-address 192.168.70.1

ip dhcp pool internal

network 192.168.70.0 255.255.255.0

default-router 192.168.70.1

dns-server 192.168.70.1

lease 0 2

ip cef

ip domain name router.com

ip name-server 87.x.x.x

ip inspect name INSPECTOUT tcp

ip inspect name INSPECTOUT udp

ip inspect name INSPECTOUT http

no ipv6 cef

multilink bundle-name authenticated

username xxxxx privilege 15 secret 5 xxxxxxxx

Re: Incoming Access List blocking Outgoing Internet Access on 87

shaw.chris — Wed, 05 Nov 2008 11:06:33 GMT

Hi, does anyone have any idea what could be causing this or debugs to use? Thanks Chris

Re: Incoming Access List blocking Outgoing Internet Access on 87

shaw.chris — Sun, 16 Nov 2008 21:48:10 GMT

Hi, could anyone help me with this please, I still haven't been able to get this problem resolved

Thanks, Chris

Re: Incoming Access List blocking Outgoing Internet Access on 87

Fernando_Meza — Mon, 17 Nov 2008 06:22:25 GMT

Hi,

Try removing the inspection from the ATM0.1 interface and place it on the BVI1 instead in the inbound direction i.e

ip inspect INSPECTOUT in

I hope it helps .. please rate helpful posts !!!

Re: Incoming Access List blocking Outgoing Internet Access on 87

remi-reszka — Wed, 19 Nov 2008 02:13:55 GMT

Hi,

Are you still having problems with your config?

I could help you but I don't wanna type here too much in case you resolved your problem.

Thanks,

Remi

Re: Incoming Access List blocking Outgoing Internet Access on 87

remi-reszka — Wed, 19 Nov 2008 02:27:37 GMT

You would need to rewrite your config a little bit. First of all I would apply your inspect rule to your inside interface in "in" direction. Also create ACL to allow all ip traffic out if you wish and apply it to the inside interface also in "in" direction.

In order for CBAC feature to work you need to specify inspected traffic like tcp or udp by creating an ACL an allowing this traffic through the interface.

For the outside interface block all the traffic "in" unless you need to allow some of it and you don't need to apply the inspect rule over there unless you allow traffic through from the outside.

The traffic once allowed from inside to outside will be inspected and allowed back into inside.

Let me know if you have any more troubles.

Remi

Re: Incoming Access List blocking Outgoing Internet Access on 87

shaw.chris — Wed, 19 Nov 2008 08:33:37 GMT

Thanks I'll give this a go,

BTW adding "ip inspect INSPECTOUT in" to the BVI interface inbound didn't work

Strange thing is, I set up another 877w which worked ok with the same inspect/ACL rules as in my config. The only difference was that it had a Dialer0 interface that I applied the rules to.

Thanks,

Chris

Re: Incoming Access List blocking Outgoing Internet Access on 87

remi-reszka — Wed, 19 Nov 2008 15:36:26 GMT

Hi,

What is this interface BVI1? I didn't work with 877W series yet, soon I'll be buying one but probably 881W. I guess it's not for wireless access.

Why don't you create a VLAN interface, add certain FastEthernet to it, add inspect rule in the same direction as you apply ACL to it. Don't forget you may need to adjust mss on the inside interface. Or even work with VLAN1 and apply rules to this interface just to check whether your config works.

Let me know how it works.

Remi

Re: Incoming Access List blocking Outgoing Internet Access on 87

shaw.chris — Wed, 19 Nov 2008 15:45:18 GMT

BVI1 is needed to set up a Bridge in order to use both the LAN ports and WLAN

Re: Incoming Access List blocking Outgoing Internet Access on 87

remi-reszka — Wed, 19 Nov 2008 15:47:37 GMT

Yeah, I found out already but thanks.

Re: Incoming Access List blocking Outgoing Internet Access on 87

shaw.chris — Sat, 22 Nov 2008 11:39:24 GMT

Hi,

I tried adding an access-rule to allow all traffic inward into the BVI1 interface along with the inspect rule inward into the BVI1 interface.

I also added the access-group inward to the ATM0.1 interface that blocks all traffic

Unfortunately the same issue occured and I can not access out from the LAN to the Internet

Regards,

Chris