topic How to Open port 80 in Network Security

How to Open port 80

engr.moaz — Fri, 21 Feb 2020 13:01:43 GMT

I have configured Basic firewall on my cisco 2911, I want to open port 80 for a packaging machine IP (192.168.0.28 255.255.252.0) which uses tcp port 80 to connect with live ip of its server in case of any technical problem, so that support technicians can access this machine. Actually it dials a VPN by using proprietry software buit in the machine. they provided me same software from which it can check if this software connects or not.

below is the snapshot of software.

How to Open port 80

Marvin Rhoads — Tue, 29 Oct 2013 15:47:52 GMT

I suspect it not that port 80 isn't open but rather the request it uses to check tcp/80 is not actually http-encoded and your firewall is inspecting tcp/80 traffic to ensure it's legitimate http and not something else masquerading as web traffic.

If you used CCP, you probably have something like the following lines in your configuration:

class-map type inspect match-all ccp-protocol-http

match protocol http

policy-map type inspect ccp-inspect

class type inspect ccp-protocol-http

inspect

If you tell the policy-map to "pass" vs. "inspect" http that will probably fix it.

How to Open port 80

engr.moaz — Wed, 30 Oct 2013 06:13:49 GMT

Thankyou for your reply

yes I used CCP for it and I found the same lines in my configuration, could you please define how to tell policy-map to allow/pass http from command line? I did not find allow or pass type in class-map, policy-map....kindly help

Re: How to Open port 80

Marvin Rhoads — Wed, 30 Oct 2013 13:36:57 GMT

The command has to be done from within the right context in the modular QOS CLI framework. First go into the policy-map and then to the class so that your command prompt shows you are in Policy-map class configuration mode ("config-pmap-c"):

#conf t

Enter configuration commands, one per line. End with CNTL/Z.

(config)#policy-map type inspect ccp-inspect

(config-pmap)#class type inspect ccp-protocol-http

(config-pmap-c)#?

Policy-map class configuration commands:

drop Drop the packet

exit Exit from QoS class action configuration mode

inspect Context-based Access Control Engine

no Negate or set default values of a command

pass Pass the packet

police Police

service-policy Deep Packet Inspection Engine

CCHS_ADMIN_R_1(config-pmap-c)#

At that point you can negate the "inspect" action and add a "pass" action.