From: Victor Cappuccio (cvictor@protokolgroup.com)
Date: Fri Sep 15 2006 - 18:39:33 ART
Hi Joe,
Let me see if I understand you question.
If you need to push traffic out from the router, and also need the Reflexive
ACL to not drop the traffic that you originate from the router, then you
need to set a local policy pointing to any loopback, in that way you make
you traffic Flow Throw through the router, and not to be originated from the
router itself
Say that we have a topology like this: R1 ---- Eth ---- R3
R1 Config#
interface Ethernet0/0
ip address 192.168.0.1 255.255.255.0
ip access-group INACL in
ip access-group OUTACL out
!
ip access-list extended INACL
evaluate MYFW
deny ip any any log !<-- This is not needed, But I like to see the logs from
traffic being denied
ip access-list extended OUTACL
permit ip any any reflect MYFW
R1#telnet 192.168.0.3
Trying 192.168.0.3 ...
% Connection timed out; remote host not responding
R1(config)#int loopback 0
R1(config-if)#ip address 150.1.1.1 255.255.255.0
R1(config-if)#route-map POLITICA:LOCAL
R1(config-route-map)#set interface loopback 0
R1(config-route-map)#ip local policy route-map POLITICA:LOCAL
R1(config)#end
R1#telnet 192.168.0.3
Trying 192.168.0.3... Open
Password required, but none set
[Connection to 192.168.0.3 closed by foreign host]
HTH
Victor.-
-----Mensaje original-----
De: nobody@groupstudy.com [mailto:nobody@groupstudy.com] En nombre de Joe
Clyde
Enviado el: Jueves, 14 de Septiembre de 2006 08:10 p.m.
Para: ccielab@groupstudy.com
Asunto: reflexive acl
I've set up a reflexive acl on my router and it appears to be
working for any thing going out the trusted interface unless it is
sourced from the router itself.
R1---->R2----->R4
Both the acls are on the interface pointing towards R4. I can telnet
or ping to R4 from R1 and that traffic shows up under the reflected acl
like it should, R4 can not telnet or ping back...again like it should.
However when I source a ping or telnet from the loopback, or any other
interface on R2 to R4, I can't get through. I remember something about
how ACLs filter traffic that come through the ports but not sourced from
them...or something like that. Any help on what I'm missing would be
appreciated. Or stated another way, how can I apply a reflexsive acl
that will permit locally sourced address?
R2 config
interface Serial0/0.24 point-to-point
description to-->r4
ip address 192.168.24.2 255.255.255.248
ip access-group notsafe in
ip access-group safe out
frame-relay interface-dlci 204
ip access-list extended notsafe
permit ospf any any
evaluate me
ip access-list extended safe
permit ip any any reflect me
This archive was generated by hypermail 2.1.4 : Sun Oct 01 2006 - 16:55:40 ART