Hey all, Got an issue with the below ACL. The inbound to the PROTECTEDSERVER is working ok.. port 80 is allowed, RDP from one trusted machine. But. on the outbound, with the deny ip any any active (notice the !), the inbound wont work, nor can the server get out.
What am I missing? Basically what I want to do is deny all, allow only certain things.. .Skeeve ! no ip access-list extended FWCUST_XXX_IN ip access-list extended FWCUST_XXX_IN remark Inbound Firewall rules for XXX Services permit tcp any host PROTECTEDSERVER established permit tcp host ALLOWEDREMOTE host PROTECTEDSERVER eq 3389 permit tcp any host PROTECTEDSERVER eq 80 permit icmp any any deny ip any any ! no ip access-list extended FWCUST_XXX_OUT ip access-list extended FWCUST_XXX_OUT remark Outbound Firewall rules for XXX Services permit tcp any any established permit tcp PROTECTEDSERVER host SAFEMAIL eq smtp permit tcp host PROTECTEDSERVER host SAFEMAIL eq pop3 permit icmp any any permit tcp host PROTECTEDSERVER any eq domain permit udp host PROTECTEDSERVER any eq domain permit tcp host PROTECTEDSERVER any eq 80 permit tcp host PROTECTEDSERVER any eq 21 permit udp host PROTECTEDSERVER any eq 20 ! deny ip any any ! ! ! interface GigabitEthernet0/2.402 ip access-group FWCUST_XXX_OUT in ip access-group FWCUST_XXX_IN out ! end ! -- Skeeve Stevens, RHCE [EMAIL PROTECTED] / www.skeeve.org Cell +61 (0)414 753 383 / skype://skeeve eintellego - [EMAIL PROTECTED] - www.eintellego.net -- I'm a groove licked love child king of the verse Si vis pacem, para bellum _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
