> On Tue, Jun 03, 2008 at 06:50:29PM +0000, Stephen Stuart wrote: > > > Hi, > > > > > > On Tue, Jun 03, 2008 at 01:37:30PM -0400, Luan Nguyen wrote: > > > > The problem is when someone contacted your protectedserver, you need to > > > > allow the counter flow of that. > > > > For example, you need to have: permit tcp host PROTECTEDSERVER eq 80 a ny gt > > > > 1024 so that the web counter flow will work (counter flow of this line : > > > > permit tcp any host PROTECTEDSERVER eq 80) > > > > > > this is not correct as there's the "tcp any any established" rule which s hould (and does) permit that. > > > > The "established" rule is present on the inbound ACL, but not the > > outbound ACL. > > hmm... what's the fourth line here (see below)? do I miss/overlook sth here?
Feh. My mistake. I didn't see that there, and it should indeed allow packets of established TCP sessions to pass. I guess the next question is, does "show ip access-list FWCUST_XXX_OUT" show any matches for that rule? Stephen _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
