Need some advice for the CBAC Firewall on a Cisco 2851 Router

[DAVID RICHWALSKI]

So I have this setup right now on the Router, So my question is this the proper way to do it?

Should I also have an ip inspect in ?

And am I putting it on the correct interface ?

ip inspect name fw dns
ip inspect name fw ftp
ip inspect name fw http
ip inspect name fw https
ip inspect name fw smtp
ip inspect name fw tcp
ip inspect name fw udp

And this is applied to the OUTBOUND Interface

interface GigabitEthernet0/1
 description PrimaryWANDesc_SPECTRUM$FW_OUTSIDE$$ETH-WAN$
 mac-address ***************
 ip address dhcp client-id GigabitEthernet0/1 hostname ******
 ip access-group 101 in
 ip mask-reply
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip nat outside
 ip inspect fw out
 ip virtual-reassembly in
 duplex auto
 speed auto
 ntp disable
 no cdp enable
 no mop enabled

[Karsten Iwen]

Generally speaking, the inspect has to be applied in the direction of the initiating traffic. If you want to dynamically allow the return-traffic for your user's session, you can apply it inbound on your internal interface or outbound on your external interface.

I always configure it outbound on the outside interface (as you did) because of two reasons:

1. All outbound traffic will flow through that interface regardless of the source interface.
2. The inspect-rules for tcp/udp/icmp can be configured with the "router-traffic" keyword. With that also the router-generated traffic to the internet is inspected.

[DAVID RICHWALSKI]

Thanks for the reply.....so I did some reading:

Security Configuration Guide Context-Based Access Control Firewall, Cisco IOS Release 15M&T

And I am still kind of lost as to how to accomplish what you have suggested....

I mean I gather from what you are saying I have it right...but is there somthing else I should add or change?

[Karsten Iwen]

I would only configure the following:

ip inspect name fw tcp router-traffic
ip inspect name fw udp router-traffic
ip inspect name fw icmp router-traffic

[Florin Barhala]

5 from me! I usually went for lan interface IN, but it makes sense now to me in regard to the "router-traffic".