IP Ipspect command placement

rakem

I'm getting a bit confused as to where to place the ip inspect commands, like on what interfaces and in what direction.

Would you ever place the command outbound on the untrusted interface??

Cisco book says to apply it inbound on untrusted interfaces so only safe traffic enters the network and outbound on all other interfaces to stop traffic going over the network

Is that accurate?

any links to some further reading would be great

lildeezul

Well according to the Cbt videos, the inspect command was on the inside interface of the edge router, and the direction was in.. Therefore when traffic was comming in on that interface, the inspect command would inspect only specific traffic, and then modify the ACL on the outside interface (in direction) to allow those inspected traffic back through.

This is how i mocked it up, but cisco implementation is probably different, with different scenarios, such as securing publicly accessed servers.

Any other thoughts anyone ?