<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>That'll work... for various values of work, and for various values of security.<br></div>
<div><br></div>
<div><br></div>
<div>On Sat, 3 Dec 2016, at 08:50, Alex Samad wrote:<br></div>
<blockquote type="cite"><div dir="ltr"><div>Hi<br></div>
<div><br></div>
<div>Let me expand a bit.<br></div>
<div><br></div>
<div>I have 2 sets of routers that have 3-4 ISP connected and I apply very broad ACL's here. They are routeros box.<br></div>
<div><br></div>
<div>They both conect to a shared vlan and then onto a single ASA5520.<br></div>
<div><br></div>
<div>I want to allow tcp packets that are part of a stream ... in through these routers.<br></div>
<div><br></div>
<div>I can't used established because in routeros it depens on the underlying firewall seeing the initial syn packet or atleast seeing an outbound tcp packet ( as I allow all out).<br></div>
<div><br></div>
<div>Working from memory. <br></div>
<div><br></div>
<div>initial packet -> Syn<br></div>
<div>initial reply -> syn,ack<br></div>
<div>3rd is syn,ack<br></div>
<div><br></div>
<div>every other packet (valid) has a ack<br></div>
<div><br></div>
<div>end is FIN (does it have an ack ?)<br></div>
<div><br></div>
<div>does RST have an ack ?<br></div>
<div><br></div>
<div>so if I allow <br></div>
<div>ack <br></div>
<div>fin<br></div>
<div>rst <br></div>
<div><br></div>
<div>packets through that should cover all the tcp packets after the initial syn<br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div>Alex<br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
</div>
<div><div><br></div>
<div defang_data-gmailquote="yes"><div>On 3 December 2016 at 00:04, Tom Storey <span dir="ltr"><<a href="mailto:tom@snnap.net">tom@snnap.net</a>></span> wrote:<br></div>
<blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204, 204, 204);border-left-style:solid;padding-left:1ex;" defang_data-gmailquote="yes"><div dir="ltr">If its a Cisco, might a reflexive ACL help?<br></div>
<div><div><br></div>
<div defang_data-gmailquote="yes"><div><div>On 2 December 2016 at 02:51, Alex Samad <span dir="ltr"><<a href="mailto:alex@samad.com.au">alex@samad.com.au</a>></span> wrote:<br></div>
</div>
<blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204, 204, 204);border-left-style:solid;padding-left:1ex;" defang_data-gmailquote="yes"><div><div><div dir="ltr"><div>Hi<br></div>
<div><br></div>
<div>having a blonde moment.<br></div>
<div><br></div>
<div>I want to set an ACL to allow TCP streams through a firewall where there is asymmetric routing in place. So a stream that might be initiated via a different path, comes via this router mid stream<br></div>
<div><br></div>
<div>If I allow tcp packets that have ACK and/or RST. that should cover all packets in a tcp stream after the initial hand shake.<br></div>
<div><span><span class="colour" style="color:rgb(136, 136, 136)"></span></span><br></div>
<div><span><span class="colour" style="color:rgb(136, 136, 136)"></span></span><br></div>
<div><span><span class="colour" style="color:rgb(136, 136, 136)"></span></span><br></div>
<div><span><span class="colour" style="color:rgb(136, 136, 136)">Alex</span></span><br></div>
<div><span><span class="colour" style="color:rgb(136, 136, 136)"></span></span><br></div>
</div>
</div>
</div>
<div><span>______________________________<wbr>_________________<br> AusNOG mailing list<br> <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br> <a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br> </span></div>
</blockquote></div>
</div>
</blockquote></div>
</div>
<div><u>_______________________________________________</u><br></div>
<div>AusNOG mailing list<br></div>
<div><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br></div>
<div><a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br></div>
</blockquote><div><br></div>
</body>
</html>