I'm setting up a 871 router
and my final config is not allowing client SFTP connections from the Internet. I think it has something to do with the way CBAC is configured. Don't totally understand how CBAC works, but wondering If I should ditch CBAC all together as I'm not sure if you can use it to inspect for connections coming into the network via the Internet...
Here's the config...I know I still need to clean up the management connections....
Current configuration : 5057 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname XXXXXXX
!
boot-start-marker
boot system flash:c870-advsecurityk9-mz.124-24.T4.bin
boot-end-marker
!
logging message-counter syslog
logging buffered 51200
logging console critical
enable secret XXXXXXXXXXXXXXXXXXXXXXXXXX
!
no aaa new-model
clock timezone UTC -8
!
crypto pki trustpoint TP-self-signed-2736937482
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2736937482
revocation-check none
rsakeypair TP-self-signed-2736937482
!
!
crypto pki certificate chain TP-self-signed-2736937482
certificate self-signed 01
3082024A 308201B3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32373336 39333734 3832301E 170D3032 30333331 30323438
34345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 37333639
33373438 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100920A 0FCE1707 3D8B3633 2E41A2F8 5C4C96AF 23A5AEC0 B0640659 F3AA845A
6487015C 95538518 5C0F52F5 7D4889D9 ACD449DA EDDC4503 D4F76A71 C2BA2C3D
BCF12AF9 7932A0AF 795299BC 154EDCAC C34A91B1 DA08CF93 018CC847 03F8924D
7298EA7E CD683EBB CE53AFA3 8B88F1C7 979226B6 39B35A45 862C5E69 BEC67548
F2A70203 010001A3 72307030 0F060355 1D130101 FF040530 030101FF 301D0603
551D1104 16301482 12496365 6C616E64 2E48616D 6D61722E 636F6D30 1F060355
1D230418 30168014 BDCA25FD EB1B03D0 084BF15C 4BCA9D15 429E6A03 301D0603
551D0E04 160414BD CA25FDEB 1B03D008 4BF15C4B CA9D1542 9E6A0330 0D06092A
864886F7 0D010104 05000381 810077DF 511A537F 23856EE2 F0AD93DE 0C369010
A51C8D16 45421549 4D61CFAC 6C9B57B2 F79E2B39 F5B3EA26 6160ED30 DE5334D9
706C53C3 BB389DE8 9265166F D603C820 DF4BA265 606C5D98 D6C9B04B 76B8D8DE
437E8BF4 2F38BBAF 3406C07E 9518CBE4 7AB24222 C33176B5 2490F824 C44F8252
B4A65137 EF64781E DFF35164 3DA8
quit
dot11 syslog
no ip source-route
ip dhcp excluded-address 192.168.1.1 192.168.1.30
!
ip dhcp pool vlan1pool
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 216.146.35.35
!
!
ip cef
ip inspect name CBAC-IN-OUT tcp
ip inspect name CBAC-IN-OUT ftp
ip inspect name CBAC-IN-OUT ftps
ip inspect name CBAC-IN-OUT h323
ip inspect name CBAC-IN-OUT rcmd
ip inspect name CBAC-IN-OUT http
ip inspect name CBAC-IN-OUT netshow
ip inspect name CBAC-IN-OUT realaudio
ip inspect name CBAC-IN-OUT rtsp
ip inspect name CBAC-IN-OUT sqlnet
ip inspect name CBAC-IN-OUT streamworks
ip inspect name CBAC-IN-OUT tftp
ip inspect name CBAC-IN-OUT udp
ip inspect name CBAC-OUT-IN ftps
no ip bootp server
no ip domain lookup
ip domain name Hammar.com
ip name-server 4.2.2.2
ip name-server 4.2.2.1
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
!
!
!
interface Loopback0
no ip address
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$
ip address dhcp
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip inspect CBAC-OUT-IN in
ip inspect CBAC-IN-OUT out
ip nat outside
no ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
description $FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
no ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 dhcp
ip http server
ip http secure-server
!
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.10 22 interface FastEthernet4 22
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit tcp any host 192.168.1.10 eq 22 log
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
access-list 101 permit udp any eq bootps any eq bootpc
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip any any log
!
!
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
login
!
scheduler max-task-time 5000
end
