I am attempting to configure CBAC on one of my 2911 routers to better secure a remote site with less configuration and cleaner access lists.
We have two circuits, a broadband circuit, and a MPLS circuit. We use IP SLA statements to do policy based routing, and use our broadband circuit for internet traffic. We are natting out our public internet interface with the LAN address space.
Below is the configuration details for CBAC and our interfaces:
ip inspect name cbac tcp
ip inspect name cbac udp
ip inspect name cbac icmp
int gi0/0
ip address LAN IP 255.255.255.0
ip nat inside
int gi0/1
ip address INTERNET IP 255.255.255.248
access-group POLICE in
ip inspect cbac out
ip nat outside
int s0/0/0:0
ip address MPLS ADDRESS 255.255.255.252
ip access-list extended POLICE
permit ip host 'OUR HQ IP ADDRESS FOR OUTSIDE MANAGEMENT' any
deny ip any any
Below are the SLA statements we use to choose our routes:
track 10 ip sla 1
delay down 1 up 1
track 20 ip sla 2
delay down 1 up 1
ip sla 1
icmp-echo MPLS NEXT HOP
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo INTERNET NEXT HOP source-interface GigabitEthernet0/1
ip sla schedule 2 life forever start-time now
When I apply the access list and the ip inspect statements where they need to be, I am unable to receive ANY traffic into this interface because our SLA no longer works. I overcame this by putting in:
5 permit ip host 'WAN NEXT HOP' any
This allowed the track to stay up, but then I was no longer able to even ping out to Google. It didn't show any sessions for the ICMP coming from any interfaces on the router using:
sh ip inspect all
or sh ip inspect session
Am I missing something goofy here? Is router traffic not considered to be LAN traffic? I read something about a command:
ip inspect name <NAME> router-traffic <TYPE>
But this doesn't exist in either our 2811 or 2911 parser.