Re: CBAC with Passive FTP

From: Dale Shaw <dale.shaw_at_gmail.com>
Date: Fri, 6 Nov 2009 08:16:19 +1100

Hi again Don,

On Fri, Nov 6, 2009 at 7:30 AM, Donald Virgil <d.virgil88_at_gmail.com> wrote:
> Hey, it works if i remove the OUT ACL or put in an allow for TCP GT 1023 but
> that defeats the purpose of the OUT ACL.

Perhaps you could permit and inspect FTP _in_ on _Gi0/0_ ? That should
take care of creating the entries you need in the OUT ACL.

Or you could shift the Gi0/1 OUT ACL to be a Gi0/0 IN ACL. (but still
perform inbound inspection on Gi0/0).

cheers,
Dale

Blogs and organic groups at http://www.ccie.net
Received on Fri Nov 06 2009 - 08:16:19 ART

This archive was generated by hypermail 2.2.0 : Tue Dec 01 2009 - 06:36:28 ART