I have configured an IOS router with CBAC/Firewall. I have configured an outbound inspect on the external interface, which adds the appropriate entries for return packets from the internet. And accordingly, I have an inbound ACL on the external interface that deny's most traffic inbound.
This works just fine when traffic is initiated by the workstations on the inside network to the internet (through the external interface), the configuration is not much different than most of the examples I have found.
My problem is that connections initiated from the router itself (DNS, telnet, traceroute, etc) do not seem to be caught by the outbound inspect, causing dynamic ACL entries to not be created for inbound data, and the return packets get denied.
Is this normal behavior for CBAC, or am I missing something simple?
Thanks for any input.
