|
|
|
If you apply an access list to inbound traffic over a USTAT or USTAT-SSL module’s eth0 interface, the implicit deny command that is automatically appended to the end of the list will prohibit access to any port not explicitly allowed by your access list.
To re-enable the default permissions, add the following lines to your access list:
remark "allows access from any host for a GRE Tunnel IP type 47 " permit 47 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 remark "allows TCP ACK packets to return, from any host (required by active probes)" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 gt 1023 established remark "allows http access for any host (required for user traffic tests)" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 80 remark "allows https access for any host (required for USTAT-SSL user traffic tests" permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 443 remark "allows icmp destination-unreachable messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 3 0 remark "allows icmp source-quench messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 4 0 remark "allows icmp time-exceeded messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 11 0 remark "allows icmp parameter-problem messages to arrive, from any host" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 12 0 remark "allows icmp echo messages to arrive, from any host pinging the interface" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 8 0 remark "allows icmp echo-reply messages to arrive, from any host pinged by CNA" permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 0 0
|
|
|