topic Re: Static bypassing ACL inside? in Network Security

Static bypassing ACL inside?

azore2007 — Mon, 11 Mar 2019 13:36:40 GMT

Hello

Need to double-check packet traversal in a pix 6.3(5)

I have webserver on the inside with public IP's.

The acl-inside is limiting access from passing the firewall towards the internet.

Webserver has the static (inside,outside) 1.1.1.1 1.1.1.1 netmask 255.255.255.0

ACL-outside has a permit ip any host 1.1.1.1

Now, to my problem.

I thought you needed to add access for the webserver (1.1.1.1) to respond back?

So acl-inside need the acl rule "permit ip host 1.1.1.1 any"

NOTE, i have a "deny ip any any" at the bottom of my ACL-inside.

need som clarification thanks 🙂

Re: Static bypassing ACL inside?

acomiskey — Wed, 27 Aug 2008 15:08:01 GMT

You do not have to allow the return traffic from the webserver in the inside acl. This is the whole point of a stateful firewall. You do however need to allow any traffic that will be initiated from the webserver through the inside interface.

Re: Static bypassing ACL inside?

azore2007 — Wed, 27 Aug 2008 17:26:59 GMT

Thank you Adam

Must be going alzheimers already 🙂