04-27-2009 10:57 AM - edited 03-11-2019 08:24 AM
I have a number of devices on the DMZ with a number of permits, but I see that last permit in the ACL is :
access-list dmz_incoming extended permit ip any any
I would like to get rid of the ACL for the obvious reason but when I do, the devices are unable to access the Internet. The permit rules I have so far is to grant access from the DMZ to the INSIDE on various vlans and ports, how would I grant access to the outside? Is there a need for an explicit ACL?
04-27-2009 11:02 AM
Roni
"how would I grant access to the outside? Is there a need for an explicit ACL?"
Yes there is because once you have applied an acl to the DMZ interface inbound then there is an implicit deny at the end so without the "permit ip any any" then the DMZ hosts would not be able to connect to the Internet.
By the way you should also have a deny somewhere in that acl ie.
permit certain traffic to inside
deny all traffic to inside
permit all traffic to outside
If you don't have a deny then it's kind of pointless.
Jon
04-30-2009 10:47 AM
here is a little trick i came up with. you can do packet captures on your firewall, that use an access list to determine what traffic to capture. Initially configure the Access-list that captures to capture ip any any. then look at your packet capture in wireshark. Examine the information to determine what ACL's you need. Then write deny statements to go above your permit ip any any (for the capture) As you progress your captures will take longer and longer. Repeat as often as necessary. Once you are not capturing traffic take your ACL and change all of your deny statements to permit take out the permit ip any any statement.
then apply that ACL to the interface, this should allow you to correctly identify all traffic, with out any real outages. Also make sure and validate that the traffic traversing the link is actually good. If you have trouble getting it to work, hire me to consult (moderately kidding ;-)
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: