Two-port router address conversion example

Two-interface router with Nat

2514 router

Current Configuration:

!

Version 12.0:

Service timestamps debug uptime

Service timestamps log uptime

No service password-Encryption

!

Hostname Horton

!

Enable secret 5 $1 $ gwrz $ YS/82lxsycgd1d5nua9ob1

Enable Password ww

!

IP subnet-zero

!

IP inspect name ethernetin cuseeme timeout 3600

IP inspect name ethernetin FTP timeout 3600

IP inspect name ethernetin h323 timeout 3600

IP inspect name ethernetin HTTP timeout 3600

IP inspect name ethernetin RCMD timeout 3600

IP inspect name ethernetin RealAudio timeout 3600

IP inspect name ethernetin SMTP timeout 3600

IP inspect name ethernetin sqlnet timeout 3600

IP inspect name ethernetin streamworks timeout 3600

IP inspect name ethernetin TCP timeout 3600

IP inspect name ethernetin TFTP timeout 30

IP inspect name ethernetin UDP timeout 15

IP inspect name ethernetin vdolive timeout 3600

!

Interface ethernet0

IP address 255.255.20.2 255.255.255.0

IP Access-group 101 in

No IP directed-broadcast

Ip nat inside

IP inspect ethernetin in

!

Interface ethernet1

No IP Address

No IP directed-broadcast

Shutdown

!

Interface serial0

IP address 150.150.150.1 255.255.255.0

IP Access-group 112 in

No IP directed-broadcast

Ip nat outside

Clockrate 4000000

!

Interface serial1

No IP Address

No IP directed-broadcast

Shutdown

!

Ip nat pool serialzero 150.150.150.3 150.150.150.255 netmask 255.255.255.0

Ip nat inside source list 1 pool serialzero

IP classless

IP Route 0.0.0.0 0.0.0.0 150.150.150.2

IP Route route 30.30.0 255.255.255.0 255.255.20.1

!

Access-List 1 permit 255.0.0.0 0.20.255.255

Access-list 101 permit TCP 255.0.0.0 0.20.255.255 any

Access-list 101 permit UDP 255.0.0.0 0.20.255.255 any

Access-list 101 permit ICMP 255.0.0.0 0.20.255.255 any

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 unreachable

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 echo-reply

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 packet-too-big

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 time-exceeded

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 Traceroute

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 administratively-prohibited

Access-list 112 permit ICMP any 150.150.150.0 0.0.255 echo

Access-list 112 permit TCP host 150.150.150.2 host 150.150.150.1 EQ Telnet

Access-list 112 deny ip 127.0.0.0 0.20.255.255 any

Access-list 112 deny ip any

!

Line con 0

Transport input none

Line aux 0

Line vty 0 4

Password ww

Login

!

End

About IP inspect name

If you deny SMTP mail on the external ACL, no external SMTP servers will ever be able to make a connection to the internal SMTP server.

CBAC is totally independent of access lists-CBAC is associated with ACLs because one function of CBAC is to ensure return traffic of

Session is permitted back to the source-however don't confuse CBAC by thinking ACLs are required. if you apply an inspect list to an interface, inspection takes place, no matter what ACLs are or are not in place. however, remember that ACLs are processed first, so the ACL must allow through the appropriate traffic to be passed thru to the inspection list.

I'm guessing your Config wocould look something like this:

! Internal interface

Interface E0 IP inspect web inbound

! External Interface

Interface E1 IP Access-group 100 in

IP inspect SMTP inbound

Access-list 100 permit TCP any host x. x EQ SMTP

Access-list 100 deny ip any

IP inspect name web HTTP

IP inspect name web FTP

IP inspect name web SMTP

IP inspect name web TCP

IP inspect name web UDP

IP inspect name SMTP

On your external ACL, you must have an opening to allow SMTP in-there is no way CBAC can automatically do this for you as traffic is first processed by the ACL and must pass. so once the SMTP traffic is allowed

In, it is passed to the inspection list SMTP, which applys SMTP protocol-based inspection (and opens up any ACLs if necessary-in this

Example this function is not required ).

Note that in this example you cocould place the SMTP inspection list on the Internal interface in the outbound direction as well. This is a better placement option if you had say a DMZ interface that was also

Grouping SMTP mail for the internal SMTP server, as you wowould only require a single inspection point (outbound on the Internal interface)

Rather than inbound on the external and DMZ interfaces.

ArticleInput: CSH responsible editor: CSH