How to remove Cisco ip inspect (cbac) statements

Question

Could anyone help me clarify how to remove "ip inspect SDM_LOW out" from a Cisco 2900 router.
Interface FastEthernet1
 description WAN-Outside
 ip inspect SDM_LOW out
I would like to remove CBAC completely and just run this router without it.  When removing this command it kills the internet connection.  I understand that when this command is removed that there is no longer an ACL allowing incoming traffic (return traffic) on the outside interface which is why http traffic is blocked.
But my question is:  On a default router config not using CBAC there is no incoming ACL on the outside interface either.  Why does the internet work in that situation?
My goal is to remove CBAC and make this router run as a standard NAT/PAT router allowing internet access.
see attached config
This topic first appeared in the Spiceworks Community

Answer 1

Mahesh,
As Rick stated, those entries are no longer dynamically created, so if you have any traffic that was inspected by the inspect rule, but explicitly denied by the acl, you'll need to modify the acl to now allow that traffic. You will need to take both acls into account when modifying them as to what type of traffic was allowed out/in by the inspect.
For example, if you have an inspect that inspects http traffic. Your acl may deny all http traffic inbound:
access-list 100 deny tcp any any eq 80
access-list 100 permit ip any any
Your inspect may allow it:
ip inspect name FW http
On your interface, you have both:
int g0/1 (wan interface)
ip inspect FW out
ip access-group 100 in
When someone on the inside needs to get to a web page, a session gets created and it allows the return traffic in even though the acl explicitly denies the http traffic. If you remove the inspects, as Rick noted, those rules don't get created any longer. Now the users would not be able to get to the internet because the acl is explicitly denying traffic coming from port 80 which includes return traffic. You would need to change acl 100 in the example to now allow 80 inbound. This is also why I said you'd need to take a look to see what the inspects were inspecting. If you have any non-standard ports configured, you'd need to take those into account in your acl.
HTH,
John