CCSP SelfStudy CCSP CSI: Exam Certification Guide, Second Edition [Electronic resources] نسخه متنی

Using the Edge Router in Medium-Sized Networks

It may be helpful to refer to Figure 16-1 to see where the edge router is located within the medium-sized network model. The edge router is the demarcation point between the ISP and the network. Its role is to provide coarse IP filtering of expected traffic and to reinforce the filtering provided by the ISP.

ISP Traffic Filtering

By using an inbound ACL, you can filter traffic that is arriving from the ISP router. This filtering is applied to the public services interface by using the command ip access-group 140 in. You should consider using the following common ACL definitions.

Apply RFC 1918 filtering. If RFC 1918 addresses are used remotely, these rules require modification accordingly.

access-list 140 deny ip 10.0.0.0 0.255.255.255 any
access-list 140 deny ip 172.16.0.0 0.15.255.255 any
access-list 140 deny ip 192.168.0.0 0.0.255.255 any

Deny any outside device from spoofing a public VLAN network address:

access-list 140 deny ip public-VLAN-network any

If required, allow IPSec traffic from the remote users or remote sites to either the PIX Firewall or VPN concentrator:

access-list 140 permit udp host remote-peer-IP host 
PIX-public-IP eq isakmp
access-list 140 permit esp host remote-peer-IP host 
PIX-public-IP
access-list 140 permit udp any host VPN-concentrator-public-IP 
eq isakmp
access-list 140 permit esp any host VPN-concentrator-public-IP

Restrict all other access to the public VLAN devices:

access-list 140 deny ip any host public-VLAN-device-IP

Permit all other connections to the public VLAN:

access-list 140 permit ip any public-VLAN-network

Deny and log all other traffic:

access-list 140 deny ip any any log

Public VLAN Traffic Filtering

By using an inbound ACL, you can filter traffic that is entering from the public VLAN interface. This filtering is applied to the public VLAN interface by using the command ip access-group 120 in. You should consider using the following common ACL definitions.

Allow management access to the edge router:

access-list 120 permit tcp host management-host-NAT-IP 
host public-VLAN-IP

Allow other public VLAN devices to use the edge router as a time server:

access-list 120 permit udp public-VLAN-network 
host public-VLAN-IP eq ntp

Allow outbound Internet Control Message Protocol (ICMP) traffic from the public VLAN devices:

access-list 120 permit icmp public-VLAN-network any

Deny all other access to the edge router:

access-list 120 deny ip any host public-VLAN-IP log

Permit all other public VLAN sourced traffic to the outside:

access-list 120 permit ip public-VLAN-network any

Block and log any other traffic:

access-list 120 deny ip any any log