Trend Content Filtering

[steve-gates]

Morning

  I currently have a Cisco 887 running Trend filtering which is all running fine and blocking url's etc. I also have a Cisco 2960 and 3 x AP's running behind the 887. I have a VPN running on the 887 to enable us to connect remotely to the devices.

My problem is with the zone security outside not enabled on the dialer interface I can telnet,ping,ftp etc fine to the devices. As soon as I enable the zone security my ability to do any of this stops. Any ideas as to what else i need to configure would be appreciated..

  Cheers

     Steve

[Jennifer Halim]

Yes, once you applied a zone to an interface, you will have to explicitly configure rules to allow access to those devices.

As you are connecting to the VPN first, I assume you have a VPN zone configured? If you do, then you will need to configure zone-pair between the VPN zone towards the inside zone, and the class map will match the traffic that you would like to allow, ie: FTP, telnet, ping,etc, with a policy-map set to "inspect".

Here is a sample configuration on ZBFW:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5710/ps1018/prod_white_paper0900aecd8062a909.html

Hope that helps.

[steve-gates]

Hi

  Thanks for the reply. I don't have anything like a VPN Zone configured, can't seem to cut and paste my config onto here either..

[steve-gates]

Some more information, We have 2 vlans configured on the router.

Vlan 1 for the seperate users traffic and Vlan 2 for the management traffic we use for the vpn.

  Vlan 1 is currently the inside zone for the security and dialer 0 is the outside, I have attached a copy of the currnt content filtering configuration

[Jennifer Halim]

1) You will need to create an access-list that says permit from VPN Client pool subnet to internal subnets

2) Create a class-map to match the access-list above

3) Create a policy-map for the above class with the action as inspect

4) Apply the policy-map to zone-pair:

zone-pair security out-to-in source outside destination inside

     service-policy type inspect