Problem with using Cisco Configuration Assistant 1.5
I configured the firewall feature of a CS871W router using Cisco Configuration Assistant v1.5. All stations inside the firewall worked well but I can't seems to ping and telnet the WAN port from another workstation over the internet the moment I set the firewall to low/medium or high. I can ping and telnet when the router is configured without the firewalling feature.
Please see attached sample router configuration and I appreciate any advice on resolving the PING and Telnet but not compromising security.
Re: Problem with using Cisco Configuration Assistant 1.5
The PIX does not dynamically allow the return packets from pings/traceroutes. For inside users to be able to ping external hosts, you need to permit Internet Control Message Protocol (ICMP) echo reply packets back through the PIX. The PIX does not dynamically open up access for the ICMP reply packets.
The solution is to apply an access-list to the outside interface permitting echo reply packets back in.
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any source-quench
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any time-exceeded
access-group 101 in interface outside
This allows only these return messages through the firewall when an inside user pings to an outside host. The other types of ICMP status messages might be hostile and the firewall blocks all other ICMP messages
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...