Validation of Router config

[fmatrine]

We hv a internet connectivity...

I want to secure my lan from internet by filtering unwanted traffic from internet, also i want to assign privilege for administration.

I hv configured access-list, antispoofing,privilege,etc..

Kindly check if the access-list flow is correct as well as total config in terms of network security.

Pls advice with config if i need to add anything else...

Attaching my internet router config for reference.

Regards

[spremkumar]

Hi

few suggestions in the config template posted by you would suggest to modify the ACL named filter which has permit and deny statements being mixed would suggest you to order them up like put all deny and permit in an order which is being followed in general and recommended too..

ip access-list extended filter

deny ip 127.0.0.0 0.0.0.255 any

deny ip 172.16.0.0 0.0.255.255 any

deny ip 192.168.0.0 0.0.0.255 any

deny ip 10.0.0.0 0.255.255.255 any

deny ip host 0.0.0.0 any

deny ip 224.0.0.0 31.255.255.255 any

permit esp any any

permit udp any any eq isakmp

permit udp any any eq 3211

permit tcp any any eq 3211

permit tcp any any eq 2068

permit tcp any any eq 8192

permit tcp any any eq ftp-data

permit tcp any any eq ftp

permit tcp any any eq www

permit tcp any any eq 120

permit tcp any any eq 443

permit tcp any any eq 990

permit tcp any any range 5631 5636

permit tcp any any range 30000 30400

regds