Hello,
I find it actually confusing to see both reflexive ACLs and IP Inspect combined. As the IP Inspect is effectively a superset of reflexive ACLs, I do not see any specific reason to combine them. Do you have any particular need to use both IP Inspect and reflexive ACLs?
Second, your IP Inspect is used in the inbound direction on your ATM/DSL interface. Is that by intent? Usually, on an outside interface, the IP Inspect is used in the outbound direction to track all connections initiated from inside, and to automatically permit replies to those connections to enter the router. However, you have the IP Inspect used in the opposite direction which, while possible, does not make much sense to me in your current deployment.
I originally wanted to directly suggest a change to your configuration but I do not understand your network well. Please try to include more info on the following topics:
- The ATM/DSL interface is marked ip nat outside. Are all internal network privately addresses and do you NAT/PAT all internal networks?
- Are there any servers in your internal networks that must be accessible from the outside (i.e. the INBOUND ACL must contain open ports for these servers and services)?
- Do you limit your internal networks to a selected set of services outside, or should the internal networks be able to access all services in the outside?
Simplifying your redundant ACL configuration is of the essence here - I believe that your current ACLs, especially when combined with the IP Inspect, are unnecessarily convoluted.
Best regards,
Peter
