access list for lower --> higher interface

[jamesagnew]

Hi

I have 3 interfaces on a PIX 515: 'inside', 'finance', 'sales' where the security priority (highest to lowest) is inside > finance > sales

I'm using PDM and am not very comfortable with the command-line just yet so please keep your explanation simple!

In the access list, there are 3 implicit rules - any traffic from any of these interfaces can reach the outside interface.

Now, I'm trying to allow mail (smtp + pop) traffic to go from sales to finance so I created a static translation rule between the two interfaces to allow correct translation from lower > higher (i.e. sales to finance)

I then created an access rule to actually allow traffic to move. Source = sales, Destination = finance, ports 25 and 110.

What happens though, is the implicit outbound rule on sales is 'overwritten' by the new rule and this prevents *any* traffic from leaving the sales interface except the traffic defined in the new rule.

Upon removing this rule, the original implicit rule gets automatically re-instated.

Could someone give me a bit of help with this, so I can understand what's actually going on and how to get the rule working properly?

Many thanks in advance for any help.

James

 

[ChrisAC]

If you are applying the access list inbound on the sales interface, then yes, traffic to the outside interface from 'sales' will be blocked. You would also have to add rules to that acl to allow ports to the internet (http, dns, ftp etc..). This is like applying an inbound list on the inside interface. Once you apply an access list to an interface, that acl is applied to all traffic regardless of destination.

So, without an ACL on 'sales' you would have the implicit rule;

Sales > Outside = Allow (high to low)
Sales > Finance = Block (low to high)
Sales > Inside = Block (low to high)

Once you put an acl inbound on sales, that affects all traffic so you now have;

Sales > Finance > tcp 25 = Allow
Sales > Finance > tcp 110 = Allow
Sales > Any = Block (this is the implicit block at the end of every acl)

So you need;

Sales > Finance > tcp 25 = Allow
Sales > Finance > tcp 110 = Allow
Sales > Outside <ports> = Allow

So after your SMTP and POP3 rules to allow this traffic to finance, you would have to then state in the acl what other traffic should be allowed. At the end of your acl any traffic not permitted by the acl will be blocked.

Sales > Any = Block.

Chris.


**********************
Chris A.C, CCNA, CCSA
**********************

 

[jamesagnew]

Thanks Chris for taking the time to answer a noobs question.

I understand the process much better now.

Cheers, James