ok..so lets say if i am initiating data from a client inside my network on some random port and on to a destination with port 80. If there is only an acl to allow specific clients from inside to outside and no other acl on the return diection i.e on the outside, will the return traffic be permitted?

In this case, how will the return traffic come back to same random port to the inside client.

Thanks!

[EDIT]: we are using an extended acl.

Sunny

"If there is only an acl to allow specific clients from inside to outside and no other acl on the return diection i.e on the outside, will the return traffic be permitted? "

Yes it will be allowed.

"In this case, how will the return traffic come back to same random port to the inside client."

Not sure i follow here. This is nothing to do with acls as such just the way TCP works ie. client uses random port, server well known port. All traffic to server will use the known well destination port, all traffic to client will use the random destination port.

Note that i'm assuming your acl is only applied inbound on the inside interface. If it was also applied outbound then this could well affect return traffic.

Jon

Thanks for your answer. Referring to the attached diag, will the return traffic from the server come back to client on the same source port that client initiated the session outbound.To verify if return is allowed without any acl.

Thanks.

Sunny

Can't read visios, could you repost as .jpg/.png

For the vast majority of TCP traffic the same ports are used for the entire conversation. Some TCP apps do change ports eg. FTP is a good example but most don't.

Jon

jpeg image is attached.

eg. i define foll acl on the lan interface of router.

acl 120 permit tcp host 192.168.200.2 10.56.20.0 255.255.255.0 eq range 5000 5200.

Now this would permit the outbound traffic from clients with 192.168.100.2 ip to server segment on 10.56.20 range on ports 5000-5200, Would the return traffic for this flow be permitted if am not applying any acl on the outside interface of the router.

Thanks!

Sunny

Your diagram doesn't match your acl. Your acl allows host 192.168.200.2 (and only this host) to connect to any device on the 10.56.20.0/24 range on ports 5000 - 5200.

Your diagram mentions port 443 ie. https. If the ports 5000 to 5200 were meant to be the source ports from the client your acl should read -

access-list 120 permit tcp host 192.168.200.2 eq range 5000 5200 10.56.20.0 0.0.0.255 (note the inverse mask)

but even that doesn't make a lot of sense because you generally don't know which random ports the client is going to use.

Could you perhaps give more detail as to what exactly you want to do ?

Jon

Oh..Please accept my apologies for the confusion. here's the scenario:

Local Hosts 192.168.200.2 - 192.168.200.254

External Servers 10.56.20.0 0.0.0.255 has services on ports 5000 to 5200.

Local hosts will be accessing this services.

Now i will only apply an acl inbound on the lan interface as

access-list 120 permit tcp host 192.168.200.0 0.0.0.255 10.56.20.0 0.0.0.255 eq range 5000 5200.

Queries:

1. will the return traffic back from server to the clients be allowed in without any block or does it need explicit acl.( i believe it should be allowed in as there is no acl , but pls correct if am wrong)

2. if one of the local client initiates session on its random port 1040 to the server on 5200, will the return traffic from server come back to this client on the same port 1040.(now destination)

How would this workout if there is no sessions being maintained.

Thanks!

Sunny

No apologies necessary.

1) No acl needed.

2) Yes it will.

"How would this workout if there is no sessions being maintained."

Not sure i follow. It works simply because of the src/dst IPs and src/dst ports but that is not a session as a firewall refers to a session. But it is enough for an acl to keep track of.

Jon

Appreciate your willingness to help!

The second part of my query was to understand how the acl will keep track of it since it is not being kept as a session as a firewall does.

& Whether the return connection would still work/be complete if the external server in response gets on to the host to another port instead of the original random port that the host used.

Thanks.