« previous next »
Pages: [1] 2 3 4

Author Topic: More Cisco Config Help Please ??  (Read 5783 times)

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
on: November 13, 2006, 12:06:34 PM
Ok, Im completely lost :(

Everything I had learnt about ip inspect has gone out of the window with the IOS upgrade I have done. It has all been replaced with ip nbar.

I have read loads on ip nbar but I cannot get anything to work correctly  :whoops:
Would someone with a little knowledge please post a really basic ip nbar setup for say allowing HTTP traffic on a NAT interface ? I just need to see how   a rule set is defined and linked to an interface. It doesnt even need to be a working config just a rough outline !!

Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #1 on: November 13, 2006, 15:29:33 PM
Stumbled across this article:
http://www.zdnet.com.au/news/security/soa/Build_a_poor_man_s_firewall_with_the_Cisco_IOS/0,130061744,120263906,00.htm

and now I might be on my way again :)
Logged
More Cisco Config Help Please ??
Reply #2 on: November 14, 2006, 14:28:30 PM
Ah yes...the joys of Cisco IOS upgrades.

Rule number 1 of Cisco IOS upgrades, never update the IOS if everything already works.

Rule number 2 of Cisco IOS upgrades, NEVER update the IOS if everything already works.

Seriously I have a contact in the European TAC and even Cisco have people dedicated to figuring out with Version of IOS works with different features/modules/interfaces/power supplies/fishing rods/jam buns.....you get the idea.

Good luck on sorting out the nbar mate, sorry I use proper firewalls as a rule.
Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #3 on: November 15, 2006, 11:44:52 AM
"proper firewalls"...
Stupidly I thought upgrading from a SMC router to a Cisco Router was moving to a "proper firewall". Turns out that I was wrong and the name of the device gives it away router !

Anyway, Im sure I should be able to get at least as much security out of the 2611 as my consumer SMC Barricade; its just more difficult to configure :)

I have now got traffic flowing in both directions, with some very simple ACLs limiting the traffic. The only thing that does not feel right about this config is that I am relying on NAT to stop most of the unsolicited traffic from getting on my LAN. I had thought that I would be able to deny everything, except where the traffic was a direct response to a NATed connection.

There in lies the question. What is wrong with this config and what should I be doing to stop unsolicited traffic whilst allowing NAT responses ?

Code: [Select]


Logged
Re:More Cisco Config Help Please ??
Reply #4 on: November 15, 2006, 17:11:31 PM
To be fair there in lies your problem is exactly right.

Routers with ACLs do not have stateful inspection as such. So on your external interface, if you want to have it ACLd youll block return packets for any traffic. Thats the nature of an ACL vs a Stateful firewall.

You would need to set-up some sort of dynamic ACL on the ingress traffic on the external interface so that it matched your outbound ACL. This cant be done. Thats why Cisco make a packet of cash selling Cisco Pix and ASA boxes.


Change your 103 access list so that its all Established packets only and then add anything else you specifically need, that would be my first step.
Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #5 on: November 15, 2006, 17:45:26 PM
Ive put a little request in with Mark to see if there is an IOS version newer than 12.2(28a) for this 2611 w/ CBAC and NBAR. If theres not I will have to try working around my previous issues with 12.2(28a).

In all honesty I am quickly reaching the point of "PCWorld are doing uPNP enabled cable routers for £40"...
Logged

  • Offline Mark

  • Posts: 3,748
  • Hero Member
Re:More Cisco Config Help Please ??
Reply #6 on: November 15, 2006, 22:56:50 PM
Sorry - been away for a biT!

If you get a bit of RAM in that box you can use one of the FW services IOSs - I will see if I have any RAM in any of my old 2600s - remember - its a multiservice platform so its a router, firewall and whatever else card you can stuff in it.

Ill also send you a config if you send me exactly your setup?
Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #7 on: November 15, 2006, 22:59:18 PM
youre too kind :)

Ill knock out a setup diagram and send you my existing (and sort of working) config so that you can have a giggle ;)

Logged

  • Offline Mark

  • Posts: 3,748
  • Hero Member
Re:More Cisco Config Help Please ??
Reply #8 on: November 15, 2006, 23:03:42 PM
Here are the feature sets available for the vanilla 2611 - note a lot need more ram than you have currently

Logged
More Cisco Config Help Please ??
Reply #9 on: November 17, 2006, 12:04:43 PM
Quick note boys, if youre going to upgrade to FW services make sure you chat about it in PM as its illegal to do so without purchasing the necessary license and therefore against forums rules. Ive also seen CCO accounts revoked for doing precisely this.

But for the record, yes if you get it onto a FW services version it should act like a cut down PIX.
Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #10 on: November 17, 2006, 12:27:11 PM
Cheers for the info :)

The 2611 that I have came with an older IP/FW/IDS IOS installed (and supplied on disk). I have to confess to not realising at the time of purchase that you cannot get updates unless you buy your kit from a certified vendor :/



Logged
More Cisco Config Help Please ??
Reply #11 on: November 17, 2006, 14:00:14 PM
You can only get updates if you have a valid support contract, these you can buy from any vendor.
Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #12 on: November 17, 2006, 15:11:00 PM
No wonder Cisco people make so much bloody money ;) :)
Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #13 on: November 18, 2006, 19:43:47 PM
Ok, next question :)
Here is my Live config !! Ive dropped back to version 12.2 for the time being...

I am having a problem that I cannot resolve...

The router hooks up to NTL fine and allows everything to access the web as required but after n minutes (variable time) the connection drops out :(

Is there anything obvious in my config causing the problem ? Like the bootps/bootpc ACL entry I had to make in order to get an NTL IP ?

Any pointers would be great :)

Code: [Select]


Logged

  • Offline Mardoni

  • Posts: 2,636
  • Global Moderator
  • Hero Member
  • On the Sofa, probably ;)
More Cisco Config Help Please ??
Reply #14 on: November 18, 2006, 23:31:15 PM
Hours later and I think Ive cracked it :)

my ACL was only permitting bootps/bootpc conversation on the private NTL network; it turns out that whilst the discovery is on that network but the lease server has a "real ip" that the ACL was blocking !
Logged
Pages: [1] 2 3 4
« previous next »

0 Members and 1 Guest are viewing this topic.