Cisco 831 w/DSL "ip inspect" best practice...

[goldbergj]

Hello,

I have set up an 831 with static IP PPPOE with the firewall feature set and have a question about best practices.

I have reviewed many configs for this setup and see no pattern as to where and in what direction to apply the "ip inspect NAME DIRECTION" command.

Some of them have it on the E1 interface coming in and some have it on the Dialer interface going out. Is there a rule of thumb and does it involve having it in the "in" and "out" on different interfaces on the same router?

Any help would be greatly appreciated as my searches have turned up nothing.

Thanks and best regards,

Jason Goldberg

CIPT-SS, CCNP, CCNA, MCP, A+

Systems Engineer

[m.singer]

As far as i have read, it is better to apply the inspect statement on the inside interface in the incoming direction (incoming to the router). This will take care of punching holes in all the ACLs if the router has multiple exit paths. Hope you agree with my thoughts....