|
|
|
If you apply an access list to inbound traffic over the management module’s eth0 interface, the implicit deny command that is automatically appended to the end of the list will prohibit access to any port not explicitly allowed by your access list.
To re-enable the default permissions, add the following lines to your access list:
remark "allows telnet access for any host" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 23 remark "allows ssh access for any host" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 22 remark "allows http access for any host" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 80 remark "allows https (SSL) access for any host" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 443 remark "allows TCP ACK packets to return from any host (for FTP, during restore)" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 gt 1023 established remark "allows CNA to be polled using SNMP from any host" permit udp 0.0.0.0 255.255.255.255 range 540 580 0.0.0.0 255.255.255.255 eq 161 remark "allows traffic from any NTP server" permit udp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 123 permit udp 0.0.0.0 255.255.255.255 eq 123 0.0.0.0 255.255.255.255 gt 1023 remark "allows DNS queries to return from any server" permit tcp 0.0.0.0 255.255.255.255 eq 53 0.0.0.0 255.255.255.255 gt 1023 permit udp 0.0.0.0 255.255.255.255 eq 53 0.0.0.0 255.255.255.255 gt 1023 remark "allows icmp destination-unreachable messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 3 0 remark "allows icmp source-quench messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 4 0 remark "allows icmp time-exceeded messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 11 0 remark "allows icmp parameter-problem messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 12 0
remark "allows icmp echo messages to arrive, from any host pinging the interface" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 8 0 remark "allows icmp echo-reply messages to arrive, from any host pinged by CNA" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 0 0 remark "allows replies from any radius server 1645 (old) and 1812 (new) port" permit udp 0.0.0.0 255.255.255.255 eq 1645 0.0.0.0 255.255.255.255 gt 1023 permit udp 0.0.0.0 255.255.255.255 eq 1812 0.0.0.0 255.255.255.255 gt 1023
|
|
|