On Thu, Dec 09, 2004 at 10:29:42AM +1000, Michael Bellears wrote: > Is it possible to apply an ACL to a VE Int? (I don't think it is...) > > Would I have to apply the acl to the eth int? Or is it not recommended > to use the SI as a "simple" firewall? > (I wanted to only allow arbitrary connections to ports 21,80+443 to the > real servers - And do not have a spare FW atm!)
conf term int ve 2 ip access-group flow-mode ip access-group 100 in Should do the trick, atleast on BigIron/NetIron Foundry Boxen. -- Cliff Albert <[EMAIL PROTECTED]> From [EMAIL PROTECTED] Thu Dec 9 06:02:15 2004 From: [EMAIL PROTECTED] (Timothy Arnold) Date: Thu Dec 9 06:01:49 2004 Subject: [f-nsp] Yet Another Nat Question Message-ID: <[EMAIL PROTECTED]> Hi Everyone, I haven?t quite figured out the benefits of using NAT but I am sure someone can tell me? ? On one VLAN of the Serveriron I have all the public IP VIP addresses, on the other VLAN I have an internal 10.x block. I have set-up inside nat for one of my servers and outbound connections will appear from the public IP that I have specified. Great!! Now, how would I configure a static mapping for the public IP addresses for incoming requests? For example. I have a VIP address that I use for Port 80 and that works fine, however, if I want to be able to admin the server via SSH, I would need to create a static mapping for incoming requests, kind of like the PIX static commands Is this possible using the Serveriron? Would I need to create a virtual server with the same IP address that I use for the inside static nat? Any ideas would be appreciated. Thanks Tim.
