Because of the un-correct visit policy the user of the internal network can’t op

Created: Mar 27, 2016 12:15:06Latest reply: Mar 28, 2016 04:01:29 1601 1 0 0 0

The client network connect to the external network by the USG2130, demands that the users of internal network can only visit the external website, can’t visit other operations, but after the configurations that the internal user can only visit the www server, found out that the internal users can’t visit the external website.Alarm Information
none

x
convention：
Emotion(0)

Like (0) Dislike (0) Favorite(0) Report

 Previous: When does the firewall clear an IPSec SA in normal cases

Next: How Many Local Users and Access Users Are Supported At Most



(0) (0)

^2#

Rickymoon Created Mar 28, 2016 04:01:29

Handling Process
1 When visit the www.sina.com, check the session table, found out a lot of http request, no DNS sessions.

2 In the ACL of the package filtering between regions, the policy permit only the WWW, reject all of the other requests.
   acl number 3005
   rule 10 permit tcp source 192.168.0.0 0.0.0.255 destination-port eq www
   rule 500 deny ip source 192.168.0.0 0.0.0.255

3 Chang the ACL rule, permit the DNS visit.
Root Cause
In the ACL of the package filtering between regions, the policy permit only the WWW, not the DNS, result in the unable to resolve the webpage.Solution
Suggestions
In the package filtering, DNS is of the uncared-for, so we should consider some crytic visit conditions.

x
convention：

Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:

Politically sensitive content
Content concerning pornography, gambling, and drug abuse
Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy

Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " User Agreement."

My Followers

Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.

Please bind your phone number to obtain invitation bonus.

Enterprise

Consumer

Corporate

Carriers

Because of the un-correct visit policy the user of the internal network can’t op

Third Party’s Trade Secret

My Followers