Thomas

I believe that your problem is in your inbound access list:

ip access-list extended sdm_fastethernet0/1_in

remark SDM_ACL Category=1

permit ip 172.20.1.0 0.0.0.255 172.25.2.0 0.0.0.255 log

permit ip 172.25.0.0 0.0.255.255 172.25.2.0 0.0.0.255 log

deny ip any 172.25.2.0 0.0.0.255 log

There is not anything in this access list that would permit incoming traffic that originated in the Internet. You can not browse the Internet if no response can get back to you. I suggest that the access list needs to be re-written to permit traffic originating from the Internet.

HTH

Rick

Hi Rick

Thanks for your contribution.

Please can you write a sample access-list statements i can add to permit traffic originating from the internet.

I appreciate your time to attend to me.

Tom

Tom

Before I can suggest a good sample access-list statement there is an issue that must be resolved. An access list is configured to implement some policy. Some policies are relatively broad in what they permit and some are quite restrictive. Your current access list rreflects a very restrictive policy. The policy restricts access to the local subnet (172.25.2.0/24) to only 2 specific subnets (172.20.1.0/24 and 172.25.0.0/16) and denies any other access. That policy does not include any Internet access. So if you are going to add Internet access then the policy must change. But what should the new policy be? Will it be a broad permit any Internet traffic? Or will it be somewhat restrictive in what is to be permitted? Once we know what they new policy should be then we can produce sample access-list statements.

HTH

Rick

Hi Rick,

Thanks for your response. You are right, our policy is very restrictive due to our job nature. But we intend to loosen up a bit and allow for Internet access. For now we want a broad permit any Internet traffic. With time we will monitor the nature of traffic we are having and know if to disallow access to specific sites and what to allow.

I will appreciate it if I will have access list statements that will help me achieve that.

Thanks

Tom

If you want to loosen up a bit the first thing that you need to do is to remove this line from the access list:

deny ip any 172.25.2.0 0.0.0.255 log

since it denies traffic from anywhere to destinations in the local LAN.

Beyond that it is a bit difficult to know what you should do. The suggestion from John about permit tcp any any established would allow responses incoming for tcp sessions established by users on the local LAN without permitting traffic initiated from the Internet. But it does not do anything for ICMP or for UDP. So perhaps the thing to do would be to add this line to the access list which will permit everything:

permit ip any any

And one could then ask that since everything is permitted whether you need the access list on the interface at all since it is not denying any traffic.

HTH

Rick

when i try to browse the system will show that server cannot be found. The DNS settings iam using on the work station are the dns server we have at our head office LAN, i even tried to add the dns address of our isp directly to the system but still no improvement.

i am not using DHCP.

Try to put this in your existing acl:

permit tcp any any eq established

Put it before your deny statement.

Let me know if that helps!

John

Hi John,

I added that but got an error message, so i added this:

permit tcp any any eq www established log

But still i could not browse from any of the systems. (NB I can ping any public address on the Internet from the router but not from the end systems)

Thanks

Do you get any hits on the line when you try to go out? You may want to try Rick's suggestion about adding "permit ip any any log" to your public acl, and then I would remove your acl that's applied to the internal interface (if there is one). also, can you do a "sh xlate" and post a few lines from that?

--John

Hi Rick

Thanks so much.

I will try this out and I will get back to you when it works.

Tom