DMZ devices

[ronshuster]

I have a number of devices on the DMZ with a number of permits, but I see that last permit in the ACL is :

access-list dmz_incoming extended permit ip any any

I would like to get rid of the ACL for the obvious reason but when I do, the devices are unable to access the Internet. The permit rules I have so far is to grant access from the DMZ to the INSIDE on various vlans and ports, how would I grant access to the outside? Is there a need for an explicit ACL?

[Jon Marshall]

Roni

"how would I grant access to the outside? Is there a need for an explicit ACL?"

Yes there is because once you have applied an acl to the DMZ interface inbound then there is an implicit deny at the end so without the "permit ip any any" then the DMZ hosts would not be able to connect to the Internet.

By the way you should also have a deny somewhere in that acl ie.

permit certain traffic to inside

deny all traffic to inside

permit all traffic to outside

If you don't have a deny then it's kind of pointless.

Jon

[chip.wagner]

here is a little trick i came up with. you can do packet captures on your firewall, that use an access list to determine what traffic to capture. Initially configure the Access-list that captures to capture ip any any. then look at your packet capture in wireshark. Examine the information to determine what ACL's you need. Then write deny statements to go above your permit ip any any (for the capture) As you progress your captures will take longer and longer. Repeat as often as necessary. Once you are not capturing traffic take your ACL and change all of your deny statements to permit take out the permit ip any any statement.

then apply that ACL to the interface, this should allow you to correctly identify all traffic, with out any real outages. Also make sure and validate that the traffic traversing the link is actually good. If you have trouble getting it to work, hire me to consult (moderately kidding ;-)