NAT - config Review

ronald.ramzy · ‎06-17-2009

Hi,

I need to allow only http traffic on the natted IP ( via acl ) and block all connection initiated from outside to inside.

Only allow connection initiated from inside to outside

M i missing anything,

********Configuration ******************

****************************************

ip subnet-zero

ip domain lookup source-interface FastEthernet0/0

ip name-server 4.4.4.4

interface FastEthernet0/0

description Connected to ISP

ip address 10.10.10.66 255.255.255.224

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/1

description Connection to LAN-Switch

ip address 192.168.1.100 255.255.255.0

ip accounting output-packets

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

ip classless

ip route 0.0.0.0 0.0.0.0 10.10.10.65

ip route 172.20.16.0 255.255.255.0 192.168.1.1

no ip http server

no ip http secure-server

ip nat inside source static 192.168.1.101 10.10.10.68

access-list 50 permit 192.168.1.101

access-list 50 deny any

Jon Marshall · ‎06-17-2009

Ronald

Where is acl 50 being used ?.

Can you just clarify, you want

1) all internal clients to be allowed to initiate connections to the Internet

AND

2) you want to allow internet access to 10.10.10.68 on port 80

If this isn't what you want can you be more specific.

Jon

ronald.ramzy · ‎06-17-2009

ACL 50 was earlier used with IP NAT Pool which i removed with static NAT.

(1) all web traffic from inside goes to ISA server. so I want Microsoft ISA Server to initiate traffic from inside to Outside

(2) No traffic should initiate from Internet to Microsoft ISA Server

Since there is no firewall, I want to secure the connection as much as possible

John Blakley · ‎06-17-2009

Ronald,

If you're wanting to allow traffic from the outside in, you can do one-to-one nat (like you are) and then block with the acl:

ip nat inside source static 192.168.1.101 10.10.10.68

ip access-list ext OUTSIDE

permit tcp any host 10.10.10.68 eq 80

permit tcp any any established

deny ip any any

int fa0/0

ip access-group OUTSIDE in

HTH,

John

HTH, John *** Please rate all useful posts ***