827 e problemi ACL, ma prima andava

[attila]

ciao a tutti

ho fatto delle prove e poi mi sono dimenticato di riabiltare la ACL 101.

l'ho riabilitata dopo qualche giorno ed improvvisamente non si riesce più a navigare .

ho ripristinato la configurazione via TFTP per essere sicuro che fosse identica a quella che avevo salvato prima di fare le prove, ma se abilito la ACL :nulla non si esce.

potrebbe essere che avendo lasciato il touter senza ACL qualcuno si sia introdotto e smanettato qualcosa?

preciso che non ho password banali

ho anche provato ad inserire una riga alla volta della ACL: appena la abilito si blocca tutto.


ecco la ver & conf:

bowtie#sh ver
Cisco IOS Software, C820 Software (C820-K9OSV6Y6-M), Version 12.3(11)T7, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Sat 30-Jul-05 09:41 by dchih

ROM: System Bootstrap, Version 12.2(4r)XM2, RELEASE SOFTWARE (fc1)

bowtie uptime is 16 hours, 22 minutes
System returned to ROM by power-on
System restarted at 19:54:40 CET Tue Feb 28 2006
System image file is "flash:c820-k9osv6y6-mz.123-11.T7.bin"


Cisco C827-4V (MPC855T) processor (revision 0xD01) with 48128K/1024K bytes of memory.
Processor board ID JAD06390G6O (1030454732), with hardware revision 0000
CPU rev number 5
4 POTS Ports
1 Ethernet interface
1 ATM interface
128K bytes of NVRAM.
12288K bytes of processor board System flash (Read/Write)
2048K bytes of processor board Web flash (Read/Write)

Configuration register is 0x2122


run
Building configuration...

Current configuration : 8521 bytes
!
! Last configuration change at 22:04:53 CET Tue Feb 28 2006 by
!
version 12.3
no service pad
service timestamps debug datetime
service timestamps log datetime
service password-encryption
service tcp-small-servers
!
hostname xxxxx
!
boot-start-marker
boot-end-marker
!
enable secret 5 xxxxxxxxxxxxxxxxx
enable password 7 xxxxxxxxxxxxxxx
!
clock timezone CET 1
clock summer-time CEST recurring last Sun Mar 3:00 last Sun Oct 3:00
aaa new-model
!
!
aaa session-id common
ip subnet-zero
ip icmp redirect host
no ip rcmd domain-lookup
ip rcmd rcp-enable
ip rcmd rsh-enable
ip rcmd remote-host gabriele 192.168.0.1 xxxxx
ip rcmd source-interface Ethernet0
ip dhcp excluded-address 192.168.0.1 192.168.0.100
ip dhcp excluded-address 192.168.0.250 192.168.0.254
!
ip dhcp pool dhcppool
import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.254
dns-server 195.130.225.119 195.130.224.18
domain-name xxxxxx
netbios-name-server 192.168.0.1
!
!
ip name-server 80.74.176.132
ip name-server 80.74.180.132
ip inspect name Firewall tcp
ip inspect name Firewall http
ip inspect name Firewall ftp
ip inspect name Firewall udp
ip inspect name Firewall h323
ip inspect name Firewall tftp
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
voice class codec 1
codec preference 1 g711alaw
codec preference 2 g729r8
!
!
!
!
!
!
!
!
!
!
!
username xxxxx password 7 xxxxx
username xpxxxx password 7 xxxxxx
!
!
translation-rule 1
Rule 0 ..% 847852477349##
!
!
no crypto isakmp ccm
!
!
!
!
interface Ethernet0
ip address 10.0.0.254 255.255.255.0 secondary
ip address 192.168.0.254 255.255.255.0
ip access-group 102 in
ip nat inside
ip inspect Firewall in
ip virtual-reassembly
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Dialer1
description Tiscali
ip address negotiated
ip nat outside
ip inspect Firewall in
ip virtual-reassembly
encapsulation ppp
dialer pool 1
no cdp enable
ppp chap hostname xxxxxxxxxxxxxx
ppp chap password 7 xxxxxxxxxxxxxxx
ppp pap sent-username xxxxxxxx password 7 x
!xxxxxxxxxxxx
ip local pool ppp-pool 192.168.0.60 192.168.0.70
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
no ip http server
no ip http secure-server
!
ip nat service sip udp port 5061
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static tcp 192.168.0.1 82 interface Dialer1 82
ip nat inside source static tcp 10.0.0.1 1450 interface Dialer1 1450
ip nat inside source static udp 10.0.0.1 1450 interface Dialer1 1450
ip nat inside source static tcp 10.0.0.1 4662 interface Dialer1 4662
ip nat inside source static udp 10.0.0.1 4672 interface Dialer1 4672
ip nat inside source static udp 192.168.0.80 1194 interface Dialer1 1194
ip nat inside source static tcp 192.168.0.80 443 interface Dialer1 1194
ip nat inside source static tcp 192.168.0.1 22 interface Dialer1 443
ip nat inside source static tcp 10.0.0.1 80 interface Dialer1 80

!
logging trap debugging
logging 192.168.0.22
access-list 1 remark The local LAN.
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 60 remark Traffic allowed telnetting from Internet
access-list 60 permit 192.168.0.0 0.0.0.255
access-list 60 deny any log
access-list 101 deny ip 172.16.0.0 0.15.255.255 any log
access-list 101 deny ip 10.0.0.0 0.255.255.255 any log
access-list 101 deny ip 127.0.0.0 0.255.255.255 any log
access-list 101 deny ip 255.0.0.0 0.255.255.255 any log
access-list 101 deny ip 224.0.0.0 7.255.255.255 any log
access-list 101 deny ip host 0.0.0.0 any log
access-list 101 deny ip 192.168.0.0 0.0.0.255 any log
access-list 101 deny ip 192.168.0.0 0.0.255.255 any log
access-list 101 permit tcp any 192.168.0.0 0.0.0.255 gt 1023 established
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 net-unreachable
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 host-unreachable
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 port-unreachable
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 packet-too-big
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 administratively-prohibited
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 source-quench
access-list 101 permit icmp any 192.168.0.0 0.0.0.255 ttl-exceeded
access-list 102 remark Traffic allowed to enter the router from the Ethernet
access-list 102 deny udp any any eq tftp
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 permit ip 10.0.0.0 0.0.0.255 any
access-list 102 permit ip any host 192.168.0.254
access-list 102 permit ip any host 255.255.255.255
access-list 102 deny ip any any log
access-list 102 remark Traffic allowed to enter the router from the Ethernet
access-list 123 permit ip host 192.168.0.18 any
snmp-server community public RO 1
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps dial
snmp-server enable traps ipmulticast
snmp-server enable traps msdp
snmp-server enable traps rsvp
snmp-server enable traps voice poor-qov
snmp-server host 192.168.0.22 public
no cdp run
!
!
control-plane
!
!
voice-port 1
echo-cancel coverage 32
no vad
bearer-cap Speech
caller-id enable
!
voice-port 2
echo-cancel coverage 32
no vad
bearer-cap Speech
caller-id enable
!
voice-port 3
echo-cancel coverage 32
no vad
bearer-cap Speech
caller-id enable
!
voice-port 4
echo-cancel coverage 32
no vad
bearer-cap Speech
caller-id enable
!
dial-peer voice 2 pots
destination-pattern xxxxxxxxxxxxxxx
port 1
!
dial-peer voice 1 voip
destination-pattern .T
voice-class codec 1
session protocol sipv2
session target sip-server
session transport udp
dtmf-relay sip-notify
no vad
!
sip-ua
authentication username xxxxx password xxxxxxxxxxx
retry invite 4
retry response 3
retry bye 2
retry cancel 2
registrar dns:212.97.59.76:5061 expires 3600
sip-server dns:212.97.59.76:5061
!
!
line con 0
exec-timeout 0 0
password 7 0317540D120E2840
history size 100
stopbits 1
speed 19200
line vty 0 4
!
scheduler max-task-time 5000
sntp server 193.204.114.233
sntp server 193.204.114.232
sntp broadcast client
end





con questa conf funziona, ma se abilito

ip access-group 101 in

sulla Dialer 1 si blocca la navigazione...


nn capisco davvero, ho controllato tutto

help!

[djdylan78]

Così ad un primo sguardo le righe seguenti bloccano tutto il traffico dalla tua rete connessa alla ethernet, la 192.168.0.0 quindi all'ingresso sull'int dialer viene droppato tutto...
access-list 101 deny ip 192.168.0.0 0.0.0.255 any log
access-list 101 deny ip 192.168.0.0 0.0.255.255 any log

[attila]

quelle righe servono per evitare traffico spooffato dall'esterno

mi spiego, dato che la access list è aplicata con questa regola

ip access-group 101 in

questa blocca il traffico in entrata, ma quello in uscita è libero


sempre dal basso della mia ignoranza...

[cisketto]

Ciao a tutti...

quello che mi chiedo io è:

Siamo sicuri che IP Inspect sia configurato correttamente?
Non lo conosco bene ma se non ricordo male funziona che:

IP INSPECT <nome> IN -> Controlla il firewall in uscita e fa passare in entrata solo il traffico di ritorno

IP INSPECT <nome> OUT ->viceversa.

IP Inspect lavora con extended-acl aprendo dei "buchi" per far rientrare il traffico....

Per com'è config il router secondo me fa il contrario:
Controlla il traffico in ingresso e fa uscire di conseguenza quello di ritorno... funziona finchè INSPECT non si attiva applicando l'acl, quando la applichi non navighi più...

Secondo me potresti provare a fare così:

Togli IP INSPECT sulla ethernet
Metti IP INSPECT firewall OUT sulla dialer
Applica L'ACL 101

In questo modo dovrebbe:

Bloccare il traffico in entrata specificato dalla 102 tranne quello di ritorno all'inspect applicato....
Bloccare in uscita solo il traffico blocca dalla acl 102

è una teoria ma tentare non nuoce...
Se non va spero che qualcuno ti possa aiutare perchè son curioso!!

[attila]

stasera provo altrimenti ora mi butto fuori e nn lo raggiungo più!


quello che mi chiedo è: perchè caricando una configuraione che andava ora nn va più! questa stessa conf andava prima!!!!

[cisketto]

Prima andava con questa stessa identica conf?
Stesso router?
Boh....

[attila]

giuro!

[attila]

farmi tutti

ieri sera ho ricaricato IOS e configurazione via tftp, reload e funziona come prima.....


non mi spiego ancora cosa possa essere successo....

grazie a tutti

[djdylan78]

L'IOS era diverso?