Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I inherited the management of a 2811 router which in addition to other things (it's our core router and VPN endpoint...I hate that it's all one box but can't break it up right now) firewalls between us and the internet using IOS Firewall. I'm familiar with firewall concepts and management but don't have much experience with any kind of Cisco firewalls, so I've been reading stuff on the web and comparing it to the 2811's configs to get a feel for it. Recently, I found this article:

article at tech republic

Which is pretty straightforward, except for the fact that on our 2811 we have ACLs on the internet interface which permit the traffic we want to permit with IOS Firewall. It's set up this way for incoming and outgoing traffic (one ACL in, one ACL out). We have "ip inspect" statements just like in the article, but our related ACLs seems to be set up the opposite of what the article says.

It does work, why does the article say to deny instead of permit?

share|improve this question

The article has misleading wording; the way you think it should work is correct. permit allows traffic, deny blocks it, and there's an implicit deny for anything that's not matched by any line in the ACL.

share|improve this answer
I have never seen an ACL that when active doesn't implicitly deny that which is on the accept or allow list. There should be no reason to use anything but the allow statements where necessary. – MaQleod Apr 20 '11 at 7:43

One thing to keep in mind about IOS firewalls is flow directions, your internet outbound traffic is incoming on the inside interface(s). For internet style traffic generally put access-groups incoming on the interfaces and inspect in/out on the external interface.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.