Newsgroup: it.comp.reti.cisco
Titolo: Firewall su 827

Salve a tutti,
non riesco a capire il criterio con il quale il Wizard del router
Cisco 827H aggiunge la funzionalita' firewall ad un cisco827H.
Il wizard cisco mi ha aggiunto la configurazione seguente:
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw http timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
poi sull'interfaccia dialer mi ha inserito:
interface Dialer1
 ip address x.x.x.x x.x.x.x
 ip access-group 111 in
 ip mtu 1492
 ip nat outside
 -----------------> ip inspect myfw out
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname router
 ppp chap password 7 104D000A0618
 ppp pap sent-username router password 7 030752180500
ip nat inside source list 102 interface Dialer1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
Poi come access list mi ha inserito:
access-list 102 permit ip 10.10.10.0 0.0.0.255 any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit esp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit tcp any any eq 1723
access-list 111 permit tcp any any eq 139
access-list 111 permit udp any any eq netbios-ns
access-list 111 permit udp any any eq netbios-dgm
access-list 111 permit gre any any
access-list 111 deny   ip any any
dialer-list 1 protocol ip permit
-----------------------
Quello che non capisco sono queste stane access-list con "permit"
applicate sul dialer1 in ingresso.
Poi non riesco a capire come lavora il comando "ip inspect myfw out"
applicato sul dialer1.
Qualcuno mi puo' aiutare a capire?
Carlo

 applicato sul dialer1.
ip inspect, serve per permettere agli host interni di aprire
"temporaneamente" in uscita (out su dialer) le sessioni che vedi nella prima
lista (cusemee, ftp, http ecc) che altrimenti verrebbero bloccate
dall'acl...
Ciao...FDD

Grazie per la risposta.
Ma perche' si usa "ip inspect myfw out" in out sulla dialer1 e non "ip
inspect myfw in" sulla porta ethernet E0?
Di regola come imposto la ip inspect myfw in in oppure in out?
Puoi darmi una dritta?
Saluti e grazie ancora.
Carlo
P.S. Nel sito della Cisco ho trovato questo esmpio di impostazione del
firewall che mi fa fare un po di confusione.
Diagramma ...
------20.20.20.20 (E0) -- Router 827H  -- (S0) [internet] 
150.150.150.1 ----
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password&#8722;encryption
!
hostname horton
!
enable secret 5 $1$GwRz$YS/82LXSYcgD1d5Nua9Ob1
enable password ww
!
ip subnet&#8722;zero
!
ip inspect name ethernetin cuseeme timeout 3600
ip inspect name ethernetin ftp timeout 3600
ip inspect name ethernetin h323 timeout 3600
ip inspect name ethernetin http timeout 3600
ip inspect name ethernetin rcmd timeout 3600
ip inspect name ethernetin realaudio timeout 3600
ip inspect name ethernetin smtp timeout 3600
ip inspect name ethernetin sqlnet timeout 3600
ip inspect name ethernetin streamworks timeout 3600
ip inspect name ethernetin tcp timeout 3600
ip inspect name ethernetin tftp timeout 30
ip inspect name ethernetin udp timeout 15
ip inspect name ethernetin vdolive timeout 3600
!
interface Ethernet0
ip address 20.20.20.2 255.255.255.0
ip access&#8722;group 101 in
no ip directed&#8722;broadcast
ip nat inside
ip inspect ethernetin in
!
interface Ethernet1
no ip address
no ip directed&#8722;broadcast
shutdown
!
interface Serial0
ip address 150.150.150.1 255.255.255.0
ip access&#8722;group 112 in
no ip directed&#8722;broadcast
ip nat outside
clockrate 4000000
!
interface Serial1
no ip address
no ip directed&#8722;broadcast
shutdown
!
ip nat pool serialzero 150.150.150.3 150.150.150.255 netmask
255.255.255.0
ip nat inside source list 1 pool serialzero
ip classless
ip route 0.0.0.0 0.0.0.0 150.150.150.2
ip route 20.30.30.0 255.255.255.0 20.20.20.1
!
access&#8722;list 1 permit 20.0.0.0 0.255.255.255
access&#8722;list 101 permit tcp 20.0.0.0 0.255.255.255 any
access&#8722;list 101 permit udp 20.0.0.0 0.255.255.255 any
access&#8722;list 101 permit icmp 20.0.0.0 0.255.255.255 any
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255
unreachable
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255
echo&#8722;reply
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255
packet&#8722;too&#8722;big
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255
time&#8722;exceeded
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255
traceroute
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255
dministratively&#8722;prohibited
access&#8722;list 112 permit icmp any 150.150.150.0 0.0.0.255 echo
access&#8722;list 112 permit tcp host 150.150.150.2 host 150.150.150.1
eq telnet
access&#8722;list 112 deny ip 127.0.0.0 0.255.255.255 any
access&#8722;list 112 deny ip any any
!
line con 0
transport input none
line aux 0
line vty 0 4
password ww
login
!
end
------------------------------------------------------