A network manager needs to allow some inbound traffic from our version of the internet. To complete this, we need to review our ACL on a border router. The device uses CBAC or IP Inspect as it's known in the CLI to allow only internal traffic back through the router (traffic must be generated internally first to be allowed back through the stateful inspection list). Usually these routers deny everything coming in on the internet facing interface - because there are some nasty folk out there.
Whilst it seems normal to create an ACL for the required ranges for the network manager, after I'd done the hard work in configuring the wildcard masks (they are odd, aren't they?) I then 'forgot' that you can only have one IP access-group either inbound or outbound on an interface. I say forgot, but I actually forgot there already was one (which said deny to anything inbound) applied to the interface. When I came to type ip access-group... I thought I'd check to see if there was one already.
And to summarise, yes there was one. And yes, the ACL I created was a waste. Instead I had to append the IP ranges and wildcards to the already configured extended access-list - taking care to ensure the deny statement was at the end of list.
So, only one IP access-group is allowed on an interface (one for each direction) - this in turn may affect how you setup your ACL's.
No comments:
Post a Comment