CBAC on 2911 Not Working Properly

Question

I am attempting to configure CBAC on one of my 2911 routers to better secure a remote site with less configuration and cleaner access lists.

We have two circuits, a broadband circuit, and a MPLS circuit. We use IP SLA statements to do policy based routing, and use our broadband circuit for internet traffic. We are natting out our public internet interface with the LAN address space.

Below is the configuration details for CBAC and our interfaces:

ip inspect name cbac tcp
ip inspect name cbac udp
ip inspect name cbac icmp

int gi0/0
ip address LAN IP 255.255.255.0
ip nat inside


int gi0/1
ip address INTERNET IP 255.255.255.248
access-group POLICE in
ip inspect cbac out
ip nat outside

int s0/0/0:0
ip address MPLS ADDRESS 255.255.255.252


ip access-list extended POLICE
permit ip host 'OUR HQ IP ADDRESS FOR OUTSIDE MANAGEMENT' any
deny ip any any

Below are the SLA statements we use to choose our routes:

track 10 ip sla 1
 delay down 1 up 1
track 20 ip sla 2
 delay down 1 up 1
ip sla 1
 icmp-echo MPLS NEXT HOP
ip sla schedule 1 life forever start-time now
ip sla 2
 icmp-echo INTERNET NEXT HOP source-interface GigabitEthernet0/1
ip sla schedule 2 life forever start-time now

When I apply the access list and the ip inspect statements where they need to be, I am unable to receive ANY traffic into this interface because our SLA no longer works. I overcame this by putting in:

5 permit ip host 'WAN NEXT HOP' any

This allowed the track to stay up, but then I was no longer able to even ping out to Google. It didn't show any sessions for the ICMP coming from any interfaces on the router using:

sh ip inspect all

or sh ip inspect session

Am I missing something goofy here? Is router traffic not considered to be LAN traffic? I read something about a command:

ip inspect name <NAME> router-traffic <TYPE>

But this doesn't exist in either our 2811 or 2911 parser.

Answer 1

This is now solved. The command that I had read was backwards. I applied the commands:

ip inspect cbac tcp router-traffic
ip inspect cbac icmp router-traffic
ip inspect cbac udp router-traffic

Which allowed me to ping out and have it remain in the state table, getting a response, and therefor keeping my SLA up and functioning.