1. Home
  2. Cisco Systems
  3. IP Inspect and Browsing issues

IP Inspect and Browsing issues

Hello. I'm having a few problems getting my ip inspect statments working properly. I have an inspect list that covers TCP and UDP outgoing, and an access list inbound that denys everything. For the most part, it works, but it doesn't load certain pages very well. Things like google maps don't load the maps, and other "dynamic" pages have problems. Has anyone else run into this before? Here are my statements:

ip inspect max-incomplete high 9000 ip inspect max-incomplete low 9000 ip inspect one-minute high 9000 ip inspect one-minute low 9000 ip inspect name MYFW tcp audit-trail on timeout 1800 ip inspect name MYFW udp audit-trail on timeout 10

interface Dialer1 ip address negotiated ip inspect MYFW out ip access-group 101 in ip access-group ALL out ip nat outside ip virtual-reassembly max-fragments 45 max-reassemblies 300 timeout

60 encapsulation ppp ip tcp adjust-mss 1452 dialer pool 1 dialer-group 1

ip access-list extended ALL permit ip any any

access-list 101 permit tcp any any eq domain access-list 101 permit udp any any eq domain access-list 101 permit tcp any any established access-list 101 permit icmp any any echo-reply access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any unreachable access-list 101 deny icmp any any

Any suggestions would be great!

Thanks, Kelly

Reply to
KB
Loading thread data ...

First of all are you sure that the inspection engine is the cause of the problem? if you remove the ACLs and the inspect commands everything works properly?

Since you use CBAC, you don't need "permit tcp any any established" in acl 101. That's what CBAC is for.

if you have confirmed that cbac makes the problem, I would suggest to add as last lines in list 101: access-list 101 deny tcp any gt 0 any gt 0 log access-list 101 deny udp any gt 0 any gt 0 log access-list 101 deny ip any any log and try to correlate the logs of the router with the pages that fail to load.

also you should add the line: ip inspect log drop-pkt , it will show you any drops that the CBAC engine does.

John

Reply to
John

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.