From: Guyler, Rik (rguyler@shp-dayton.org)
Date: Thu Nov 08 2007 - 17:49:55 ART
My reply wasn't really meant for anything specifically but just a
generalization. Some people have a hard enough time with interpreting
the requirements so by introducing additional configs you are increasing
the chances of doing something that will cost you points. In this case,
if OSPF was already running through the interface and the next
requirement said to ONLY allow those protocols, I guess you would either
have to find a workaround or decide which section will lose fewer points
by breaking the rules.
Rik
________________________________
From: Tarun Pahuja [mailto:pahujat@gmail.com]
Sent: Thursday, November 08, 2007 3:41 PM
To: Guyler, Rik
Cc: groupstudy
Subject: Re: Reflexive output ACL
Rik,
What would happen if the Link was already running OSPF and you
enable a firewall that should only allow ICMP,TCP,UDP? You Just lost
connectivity!
HTH,
Tarun
On Nov 8, 2007 2:39 PM, Guyler, Rik <rguyler@shp-dayton.org> wrote:
Don't do it if it isn't asked for in the requirements. If it
says ICMP,
TCP and UDP then allow those and move on. When you start taking
unnecessary steps you run even greater risk of missing a
required topic
due to misinterpretation.
Maybe this question really means "allow ONLY ICMP, TCP and UDP
inbound"
and so allowing other non-required protocols just cost you
points. Why
complicate things any more?
Rik
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On
Behalf Of
hadek.el-ayachi@nsn.com
Sent: Thursday, November 08, 2007 11:47 AM
To: ccielab@groupstudy.com
Subject: Reflexive output ACL
Hi GS,
If I am asked to permit only icmp/udp/tcp traffic inbound if it
is
initiated from inside, the answer is:
ip access-list ext FW_OUT
permit icmp an an reflect FW
permit tcp an an reflect FW
permit udp an an reflect FW
But, what about other protocols and futur protocols sach as
igmp,
gre...? Should I add per ip any any? Does it deserve askin
proctor?
Thanks for comment
E. HADEK
Nokia Siemens Networks
IP Core planner
5 rue Abou Inane- Hassan
Rabat - Maroc
Tel : +212 37 26 15 30
GSM : + 212 61 44 93 98
This archive was generated by hypermail 2.1.4 : Sat Dec 01 2007 - 06:37:29 ART