Доброго времени!
Конфигурация такая: есть роутер Cisco 2600, стоящий файерволом на границе DMZ-WAN, который интерфейсом fa0/0 с приватным ip (192.168.100.50) включен в сеть провайдера. Внешний же ip подключен в DMZ. В DMZ также находится комп являющийся шлюзом в локальную сеть.Конфиг:
Current configuration : 3274 bytes
!
! Last configuration change at 12:17:40 MSK Tue Apr 26 2005
! NVRAM config last updated at 19:08:07 MSK Thu Apr 21 2005
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname
logging queue-limit 100
logging buffered 4096 debugging
enable secret 5
enable password
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
call rsvp-sync
!
interface FastEthernet0/0
ip address 192.168.100.50 255.255.255.224
speed 10
half-duplex
!
interface FastEthernet0/1
ip address 62.89.247.201 255.255.255.248
ip access-group 120 in
duplex auto
speed auto
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.100.33
no ip http server
!
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq www log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq 443 log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq 17988 log
access-list 110 permit udp any 62.89.247.200 0.0.0.7 eq 17988 log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq domain log
access-list 110 permit udp any 62.89.247.200 0.0.0.7 eq domain log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq 1433 log
access-list 110 permit udp any 62.89.247.200 0.0.0.7 eq 1434 log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq pop3 log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq nntp log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq 143 log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq smtp log
access-list 110 permit udp any 62.89.247.200 0.0.0.7 eq 25 log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 range ftp-data telnet log
access-list 110 permit udp any 62.89.247.200 0.0.0.7 range 22 23 log
access-list 110 permit udp any 62.89.247.200 0.0.0.7 eq ntp log
access-list 110 permit tcp any 62.89.247.200 0.0.0.7 eq 3389 log
access-list 110 permit icmp any any net-unreachable
access-list 110 permit icmp any any host-unreachable
access-list 110 permit icmp any any port-unreachable
access-list 110 permit icmp any any parameter-problem
access-list 110 permit icmp any any packet-too-big
access-list 110 permit icmp any any administratively-prohibited
access-list 110 permit icmp any any source-quench
access-list 110 permit icmp any any echo-reply log
access-list 110 permit icmp any any ttl-exceeded
access-list 110 deny   icmp any any
access-list 120 permit ip any any
access-list 120 permit icmp any any net-unreachable
access-list 120 permit icmp any any host-unreachable
access-list 120 permit icmp any any port-unreachable
access-list 120 permit icmp any any parameter-problem
access-list 120 permit icmp any any packet-too-big
access-list 120 permit icmp any any administratively-prohibited
access-list 120 permit icmp any any source-quench
access-list 120 permit icmp any any echo-reply log
access-list 120 permit icmp any any ttl-exceeded
access-list 120 deny   icmp any any
snmp-server community public1 RO
snmp-server enable traps tty
!
dial-peer cor custom

line con 0
line aux 0
line vty 0 4
password
login
!
В приведенном конфиге на интерфейсе fa0/0 нет назначенной access-group,а по идее там должно быть следующее "ip access-group 110 in".
Но как только прописываешь это дело на интерфейс, пропадает http трафик в локалке.
Господа, подскажите что может быть не так с этим конфигом ?