ACL on WAN interface to block external access

[Shahzad Ayub]

Hi,

I want to apply an ACL on the WAN interface facing to ISP which is configured with a public IP. Our router model is 2921 ISR and we are also running sip trunk services on same router.

We have one Video conference endpoint device with Public IP nat to a private IP.

We also have one site to site ipsec vpn with a far site.

Our goal is to block unnecessary hits to our internal network from outside as we don't have any firewall on the edge so i want to achieve this through an ACL and need expert's help in this regards.

while blocking external traffic i want to allow specific public IPs which can dial to our video conference endpoint, we have public IPs on both ends.I also don't want to disturb vpn traffic and sip traffic for inbound and outbound calls.

ip access-list extended ExternalAccess
permit ip 212.16.178.169 0.0.0.3 37.56.78.33 0.0.0.3 ------ to allow far site video endpoint with complete pool
deny ip any 37.56.78.33 0.0.0.3
permit ip any any

int GigabitEthernet0/0
ip access-group ExternalAccess in

Thanks

Shahzad

[Georg Pauwen]

Hello Shazad,

take a look at this post and the response form Karsten Iwen, he proposes a very efficient access list and optional inspection:

https://supportforums.cisco.com/discussion/11605286/access-lists-internet-router

[Shahzad Ayub]

Hi,

By putting "ip inspect" commands, it will match the session table, it means to allow somebody to dial our polycom from their side we have to first dial from our side to add them in session table, right?

Thanks

Shahzad

[Georg Pauwen]

Hello Shahzad,

if you explicitly allow your Polycom traffic in both directions, it will not be inspected. So:

permit ip 212.16.178.169 0.0.0.3 37.56.78.33 0.0.0.3

will allow the traffic if initiated from the outside, and bypass inspection.

[Shahzad Ayub]

we also have ipsec site to site vpn with far site, what about that ?

Do i need to allow explicitly traffic from vpn peer in same ACL?

permit esp any any
permit udp any any eq isakmp

Thanks

Shahzad

[Georg Pauwen]

Hello Shazad,

for VPN access, configure the following:

access-list 101 permit 50 any any
access-list 101 permit 51 any any
access-list 101 permit udp any eq 500 any eq 500

The 'any' can be replaced by the respective VPN peers.

[Shahzad Ayub]

Hi 

Thanks for your support.

How does it impact memory of router if we don't put any timeout values because we will be having unlimited number of sessions established.

Thanks

Shahzad

[Georg Pauwen]

Shahzad,

CBAC has default timeout values, so the number of established session is kept in check automatically. Have a look at this table for the relevant values:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7c5.html#wp1001343