I inherited the management of a 2811 router which in addition to other things (it's our core router and VPN endpoint...I hate that it's all one box but can't break it up right now) firewalls between us and the internet using IOS Firewall. I'm familiar with firewall concepts and management but don't have much experience with any kind of Cisco firewalls, so I've been reading stuff on the web and comparing it to the 2811's configs to get a feel for it. Recently, I found this article:

article at tech republic

Which is pretty straightforward, except for the fact that on our 2811 we have ACLs on the internet interface which permit the traffic we want to permit with IOS Firewall. It's set up this way for incoming and outgoing traffic (one ACL in, one ACL out). We have "ip inspect" statements just like in the article, but our related ACLs seems to be set up the opposite of what the article says.

It does work, though...so why does the article say to deny instead of permit?


The article has misleading wording; the way you think it should work is correct. permit allows traffic, deny blocks it, and there's an implicit deny for anything that's not matched by any line in the ACL.

  • I have never seen an ACL that when active doesn't implicitly deny that which is on the accept or allow list. There should be no reason to use anything but the allow statements where necessary. – MaQleod Apr 20 '11 at 7:43

One thing to keep in mind about IOS firewalls is flow directions, your internet outbound traffic is incoming on the inside interface(s). For internet style traffic generally put access-groups incoming on the interfaces and inspect in/out on the external interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy