Re: CISCO FW IOS with allowing SSH to it from outside

From: Sam Munzani (sam@xxxxxxxxxxx)
Date: Wed Feb 14 2001 - 17:02:17 GMT-3


   
RE: CISCO FW IOS with allowing SSH to it from outsideIf you don't apply =
and outbound access-list, that means you permit everything outbound with =
stateful inspection. Inbound is taken care by drilling holes in =
access-list. I don't have much luck with it so far. Telnet from inside =
works great though.

Sam
  ----- Original Message -----=20
  From: Rampley, Jim=20
  To: 'Sam Munzani' ; Ron.Fuller@3x.com=20
  Cc: ccielab@groupstudy.com ; NoOne Important ; nobody@groupstudy.com=20
  Sent: Wednesday, February 14, 2001 1:43 PM
  Subject: RE: CISCO FW IOS with allowing SSH to it from outside

  Don't you need an outbound access-list on fa0/1? I just set this up a =
few weeks back from the doc CD examples and was able to telnet both =
ways.

  Jim=20

    -----Original Message-----=20
    From: Sam Munzani [SMTP:sam@munzani.com]=20
    Sent: Tuesday, February 13, 2001 1:52 PM=20
    To: Ron.Fuller@3x.com=20
    Cc: ccielab@groupstudy.com; NoOne Important; =
nobody@groupstudy.com=20
    Subject: Re: CISCO FW IOS with allowing SSH to it from =
outside=20

    Here is my full configs with IP addresses changed a bit. Tell me =
what am I=20
    doing wrong?=20

    version 12.1=20
    no service single-slot-reload-enable=20
    service timestamps debug uptime=20
    service timestamps log uptime=20
    service password-encryption=20
    !=20
    hostname cisco=20
    !=20
    logging buffered 4096 debugging=20
    logging rate-limit console 10 except errors=20
    aaa new-model=20
    aaa authentication login default local=20
    enable password 7 045C1E031C32455A=20
    !=20
    username admin password 1234=20
    ip subnet-zero=20
    no ip source-route=20
    !=20
    !=20
    no ip finger=20
    ip domain-name xyz.com=20
    ip name-server 1.1.1.1=20
    !=20
    ip inspect max-incomplete high 1100=20
    ip inspect max-incomplete low 900=20
    ip inspect one-minute high 1100=20
    ip inspect one-minute low 900=20
    ip inspect name outbound tcp=20
    ip inspect name outbound udp=20
    ip inspect name outbound cuseeme=20
    ip inspect name outbound ftp=20
    ip inspect name outbound h323=20
    ip inspect name outbound rcmd=20
    ip inspect name outbound realaudio=20
    ip inspect name outbound smtp=20
    ip inspect name outbound streamworks=20
    ip inspect name outbound vdolive=20
    ip inspect name outbound sqlnet=20
    ip inspect name outbound tftp=20
    !=20
    ip inspect name mail smtp=20
    !=20
    ip audit notify log=20
    ip audit po max-events 100=20
    ip ssh time-out 60=20
    ip ssh authentication-retries 3=20
    !=20
    !=20
    call rsvp-sync=20
    cns event-service server=20
    !=20
    !=20
    !=20
    interface FastEthernet0/0=20
     description connection to Internal Network=20
     ip address 192.168.100.2 255.255.255.0=20
     ip nat inside=20
     duplex auto=20
     speed auto=20
    !=20
    interface FastEthernet0/1=20
     description Connection to Internet=20
     ip address 2.2.2.2 255.255.255.0=20
     ip access-group 101 in=20
     ip nat outside=20
     ip inspect outbound out=20
     ip inspect mail in=20
     duplex auto=20
     speed auto=20
    !=20
    ip kerberos source-interface any=20
    ip nat pool legal_ip 2.2.2.3 2.2.2.10 netmask 255.255.255.0=20
    ip nat inside source route-map nonat pool legal_ip overload=20
    ip nat inside source static 192.168.100.5 2.2.2.15=20
    ip classless=20
    ip route 0.0.0.0 0.0.0.0 2.2.2.1=20
    no ip http server=20
    !=20
    logging source-interface FastEthernet0/0=20
    logging 192.168.100.11=20
    access-list 101 permit tcp any host 2.2.2.15 eq smtp=20
    access-list 101 permit tcp any host 2.2.2.15 eq www=20
    access-list 101 permit tcp any host 2.2.2.15 eq 443=20
    access-list 101 permit tcp any host 2.2.2.15 eq pop3=20
    access-list 101 permit tcp any host 2.2.2.15 eq 143=20
    access-list 101 permit tcp any host 2.2.2.2 eq 22=20
    access-list 101 permit tcp any host 2.2.2.2 eq telnet=20
    access-list 101 deny tcp any any=20
    access-list 101 deny udp any any=20
    access-list 101 permit icmp any any echo-reply=20
    access-list 101 permit icmp any any time-exceeded=20
    access-list 101 permit icmp any any packet-too-big=20
    access-list 101 permit icmp any any traceroute=20
    access-list 101 permit icmp any any unreachable=20
    access-list 101 deny ip any any log=20
    access-list 160 permit ip any any=20
    no cdp run=20
    !=20
    route-map nonat permit 10=20
     match ip address 160=20
    !=20
    !=20
    !=20
    line con 0=20
     exec-timeout 0 0=20
     password 7 094F471A1A0A=20
     transport input none=20
    line aux 0=20
     password 7 070834495D1A1011=20
    line vty 0 4=20
     password 7 104D000A0618=20
     transport input telnet ssh=20
    !=20
    end=20



This archive was generated by hypermail 2.1.4 : Thu Jun 13 2002 - 10:28:48 GMT-3