|
|
|
If you apply an access list to inbound traffic over the engine module’s eth0 interface, the implicit deny command that is automatically appended to the end of the list will prohibit access to any port not explicitly allowed by your access list.
To re-enable the default permissions, add the following lines to your access list:
remark "allows TCP ACK packets to return from any host (required for BGP traffic)" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 gt 1023 established remark "allows traffic from an SNMP polling action to return" permit udp 0.0.0.0 255.255.255.255 eq 161 0.0.0.0 255.255.255.255 range 540 580 remark "allows an icmp destination-unreachable message to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 3 0 remark "allows an icmp source-quench message to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 4 0 remark "allows an icmp time-exceeded message to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 11 0 remark "allows an icmp parameter-problem message to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 12 0 remark "allows icmp echo messages to arrive, from any host pinging the interface" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 8 0 remark "allows icmp echo-reply messages to arrive, from any host pinged by CNA" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 0 0
|
|
|