|
Posted by Vincent on June 24, 2008, 8:22 pm
If you were Registered and logged in, you could reply and use other advanced thread options >
>
>
>
>
> > =A0 =A0 =A0I'm a bit of a novice with Cisco routers, so please forgive m=
e if
> > I do not explain this clearly. =A0Our company has a T1 line that
> > connects through our Cisco 877 router. =A0We have been given a block of
> > public IP addresses (3 I think), but are currently only using one of
> > these addresses. =A0We would like to use one of the other public IP
> > addresses for our ftp server. =A0I already know how to port forward the
> > traffic to the secondary IP address, like so:
>
> > ip nat inside source static tcp x.x.x.x 21 x.x.x.x 21 extendable
>
> > =A0 =A0 =A0But, if I do this, the ip inspection rules that are being app=
lied
> > to the public IP address I use now (x.x.x.y) are not being applied to
> > this connection. =A0In particular:
>
> > ip inspect name CBAC-FTP ftp
>
> > interface FastEthernet 4
> > =A0 ip address x.x.x.y 255.255.255.248
> > =A0 ....
> > =A0 ip inspect CBAC-FTP in
>
> > =A0 =A0 =A0I have read that you can add a secondary ip address to the sa=
me
> > interface. =A0Is this what I would have to do in this situation or is
> > there another preferred method of handling this?
>
> > interface FastEthernet 4
> > =A0 ip address x.x.x.y 255.255.255.248
> > =A0 ip address x.x.x.x 255.255.255.248 secondary (Should I do this?)
>
> > =A0 =A0 =A0Thank you for your assistance.
>
> > Vincent
>
> Vincent,
> You don't have to add a secondary ip to the outside interface.
> Adding the "ip inspect" CBAC-FTP in" command to the Fa4 interface will
> inspect the FTP traffic coming into the interface.
>
> What you have there seems to be correct.
> What leads you to believe that the traffic coming in the interface is
> not being inspected?
>
> -JC- Hide quoted text -
>
> - Show quoted text -
JC,
The traffic coming into the Fa4 interface IS being inspected on
the IP address assigned to this interface (x.x.x.x), but it IS NOT on
the IP address that is being port forwarded (x.x.x.y). If I try to
perform passive ftp over x.x.x.x, it works correctly but it does not
over x.x.x.y. I hope I explained this somewhat clearly.
Vincent
| 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML site map