I have just been handed over infra without diagrams or information as the previous guy left without notice. Hope experts here can enlighten me or at least point me in the right direction. Everything was working fine till our proxy server went down. I am not sure how the previous implementation "forced" internet traffic through the proxy.
- Disabled proxy (such as on application level or internet browsers) but there is still no internet access.
- Previously working fine with a 3rd party proxy.Other Network Security Topics
- Checkpoint Firewall accepts traffic to internet (tested with sites like google.com and 8.8.8.8) based on logs. Therefore my guess is the traffic is dropped somewhere on the router after the firewall.
- Possible it's the ACL causing the problems? Is it the ACL "BLOCK_INB" blocking all return traffic?
The company is using Checkpoint as it's firewall solution with a Cisco 2911 ISR facing the Internet / acting as the WAN router. To simply, its like this:
Clients/Servers/Devices ---> Switch --> Checkpoint FW ---> DMZ Switch --> Cisco 2911 WAN Router --> Internet
Here is the router config:
interface Port-channel1
description to CP-FW
ip address 203.X.X.29 255.255.255.224
ip access-group 102 in
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description WAN Internet
ip address 164.x.x.230 255.255.255.252
ip access-group BLOCK_INB in
no ip redirects
no ip unreachables
no ip proxy-arp
duplex full
speed 100
!
interface GigabitEthernet0/1
description To DMZSwitch
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
channel-group 1
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 164.X.X.229
ip route 192.168.5.0 255.255.255.0 203.X.X.30
ip route 203.X.X.0 255.255.255.224 203.X.X.30
ip ssh time-out 60
ip ssh version 2
ip ssh server algorithm mac hmac-sha1
ip ssh server algorithm encryption aes256-ctr
ip ssh client algorithm mac hmac-sha1
ip ssh client algorithm encryption aes256-ctr
!
!
ip access-list extended BLOCK_INB
deny ip 127.0.0.0 0.255.255.255 any log
deny ip 10.0.0.0 0.255.255.255 any log
deny ip 0.0.0.0 0.255.255.255 any log
deny ip 172.16.0.0 0.15.255.255 any log
deny ip 192.168.0.0 0.0.255.255 any log
deny ip 192.0.2.0 0.0.0.255 any log
deny ip 169.254.0.0 0.0.255.255 any log
deny ip 224.0.0.0 31.255.255.255 any log
deny ip host 255.255.255.255 any log
permit ip any any log
deny ip any any log
!
access-list 101 deny icmp any any redirect
access-list 101 deny icmp any any timestamp-request
access-list 101 deny icmp any any information-request
access-list 101 deny 53 any any
access-list 101 deny 55 any any
access-list 101 deny 77 any any
access-list 101 deny pim any any
access-list 101 deny ip 0.0.0.0 0.255.255.255 any log
access-list 101 deny ip 10.0.0.0 0.255.255.255 any log
access-list 101 deny ip 127.0.0.0 0.255.255.255 any log
access-list 101 deny ip 161.229.0.0 0.0.255.255 any log
access-list 101 deny ip 169.254.0.0 0.0.255.255 any log
access-list 101 deny ip 172.0.0.0 0.31.255.255 any log
access-list 101 deny ip 192.168.0.0 0.0.255.255 any log
access-list 101 deny ip 224.0.0.0 31.255.255.255 any log
access-list 101 deny ip 255.0.0.0 0.255.255.255 any log
access-list 101 deny udp any any eq 0
access-list 101 permit ip any any log
access-list 102 permit ip 203.X.X.0 0.0.0.31 any
access-list 102 permit ip 192.168.5.0 0.0.0.255 any
access-list 102 deny udp any any eq 0
access-list 102 deny ip any any log
access-list 103 deny udp any any eq 0
access-list 103 permit ip any any log
