What platform is this on again? If you want to use a Cisco IOS router as a firewall, why don't you use the firewall features and configure CBAC?
Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS Senior Network Engineer Coleman Technologies, Inc. 954-298-1697 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Blayzor Sent: Wednesday, June 04, 2008 8:35 AM To: Ziv Leyes Cc: [email protected] Subject: Re: [c-nsp] ACL making me insane On Jun 4, 2008, at 7:25 AM, Ziv Leyes wrote: > There's no way to use "established" for UDP though, so I can share > what works for me, I call them "operational rules" because they suit > everything I need to allow that is host initiated/related for its > own functionality, of course you could add some more rules to permit > other tcp/udp ports to reach the desired host/net. Of course not.. ACL's are very basic and are not stateful in any way. So if you're trying to use it in that way, it's very difficult and you end up with a lot of "loose" rules. Of course for DNS you could just allow responses from the DNS server from UDP port 53 to any port > 1023, but it's loose. If you have a recursive DNS server inside of that ACL, then you're going to have to allow from ALL IP's from port UDP port 53. Keep your ACL's basic and to the point, trying to make them overly complicated to replace a stateful firewall kind of defeats the purpose and ends up being more trouble than it's worth. (IMHO) -- Robert Blayzor, BOFH INOC, LLC [EMAIL PROTECTED] http://www.inoc.net/~rblayzor/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
