Hi,
On Tue, Jun 03, 2008 at 06:50:29PM +0000, Stephen Stuart wrote: > > Hi, > > > > On Tue, Jun 03, 2008 at 01:37:30PM -0400, Luan Nguyen wrote: > > > The problem is when someone contacted your protectedserver, you need to > > > allow the counter flow of that. > > > For example, you need to have: permit tcp host PROTECTEDSERVER eq 80 any > > > gt > > > 1024 so that the web counter flow will work (counter flow of this line: > > > permit tcp any host PROTECTEDSERVER eq 80) > > > > this is not correct as there's the "tcp any any established" rule which > > should (and does) permit that. > > The "established" rule is present on the inbound ACL, but not the > outbound ACL. hmm... what's the fourth line here (see below)? do I miss/overlook sth here? thanks, Enno > no ip access-list extended FWCUST_XXX_OUT > ip access-list extended FWCUST_XXX_OUT > remark Outbound Firewall rules for XXX Services > permit tcp any any established > permit tcp PROTECTEDSERVER host SAFEMAIL eq smtp > permit tcp host PROTECTEDSERVER host SAFEMAIL eq pop3 > permit icmp any any > permit tcp host PROTECTEDSERVER any eq domain > permit udp host PROTECTEDSERVER any eq domain > permit tcp host PROTECTEDSERVER any eq 80 > permit tcp host PROTECTEDSERVER any eq 21 > permit udp host PROTECTEDSERVER any eq 20 > ! deny ip any any Adding an "established" rule to the outbound ACL would > fix things (but might allow more communication than Skeeve desires); > Luan's correction to the outbound rules would fix things, as well. > > Stephen -- Enno Rey ERNW GmbH - Breslauer Str. 28 - 69124 Heidelberg - www.ernw.de Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 PGP FP 055F B3F3 FE9D 71DD C0D5 444E C611 033E 3296 1CC1 Handelsregister Heidelberg: HRB 7135 Geschaeftsfuehrer: Roland Fiege, Enno Rey _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
