IP inspect in-out on same interface

Unanswered Question
Aug 21st, 2009


I am having a Cisco 2851 router with IOS firewall software(c2800nm-advipservicesk9-mz.124-15.T6.bin). I need to have two access-groups (one for in, and one for out) on the same interface.

Traffic initiated from this interface (so matched by the "in" access-list) is blocked by the "out" access-list. But in my opinion it shouldn't be blocked because the inspect configuration should permit it. Does somebody know what the problem is?

ip inspect name ABC udp

ip inspect name ABC x11

ip inspect name ABC tcp


interface GigabitEthernet0/0.12

description ABC_vlan

encapsulation dot1Q 12

ip address

ip access-group ABC_in in

ip access-group ABC_out out

ip inspect ABC in

ip inspect ABC out


ip access-list extended ABC_in

permit tcp eq 6000

permit tcp eq 3389

deny ip any any log

ip access-list extended ABC_out

permit tcp host host eq 445

deny ip any any log

abc#show ip inspect sess

Established Sessions

Session 47B88C00 (>( x11 SIS_OPEN


abc#show log

Aug 21 11:21:45.411 CET: %SEC-6-IPACCESSLOGP: list ABC_out denied tcp ->, 1 packet

*Modified the IP addresses, to fictual addresses *

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Peter Paluch Fri, 08/21/2009 - 14:54


Do you need to have the "ip inspect" in both directions on your interface? I am not saying right now that it is not allowed but it is kind of unusual.

Second, from the output you have posted, I am confused by the "show log" output. It says that a packet destined to was denied by the ABC_out. However, the ABC_out is applied on the Gi0/0.12 in the outbound direction (for packets going out that interface) and the IP is the address of the Gi0/0.12 itself. From this it follows that the log entry describes an impossible situation:

1) The ABC_out could capture and drop this packet only if it was sent out the interface Gi0/0.12. However, a packet would never be sent out an interface if the interface's address is the same as the destination of the packet.

2) If the packet was coming into the Gi0/0.12 interface, the outbound ACL ABC_out was not consulted for that packet at all. It is thus impossible for it to log a drop.

Can you please double check the posted configuration and clarify this?

Best regards,


jmaat Mon, 08/24/2009 - 01:07

Hi Paluchpeter,

Apparently I made a typo. (I adjusted the IP addresses, I also mentioned this in the post)

The IP address of the inferface should be

interface GigabitEthernet0/0.12

description ABC_vlan

encapsulation dot1Q 12

ip address

I need to have the in/out access-list on both directions, otherwise my access-list configuration will be very long. The rest of the interface are not having any restrictions.

I am sorry for the confusion,

Thanks and regards,



This Discussion