Security

Ask something
Discussion Locked

ACL Statements

0 helpful
4 replies

by mdl3

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

ok Im trying to permit 134.33.0.0 DNS & HTTP only from 140.40.0.0 also permit 134.33.0.0
DNS(53) POP(3) Library server (2)only from 148.52.0.0 and permit IP to any body else, my question is would these statements on my ACL acomplish it? is it vallid? please is there is a better way to acomplish that please explain/
Thanks again!
MDL3

4 replies

by mdl3

sorry! I forgot the actual statement daaa!
Access-list 101 permit TCP host 134.33.0.0 140.40.0.0 0.0.255.255 eq 80
Access-list 101 permit TCP host 134.33.0.0 140.40.0.0 0.0.255.255 eq 53
Access-list 101 permit TCP host 134.33.0.0 148.52.0.0 0.0.255.255 eq 53
Access-list 101 permit TCP host 134.33.0.0 148.52.0.0 0.0.255.255 eq 3
Access-list 101 permit TCP host 134.33.0.0 148.52.0.0 0.0.255.255 eq 2
Access-list 101 permit IP any any

by shanghai sam

No. That ACL won't work. If the traffic doesn't meet one of the first permit rules, it will be allowed by the permit ip any any at the bottom.
You have made a Permit Specific with a Permit All at the end. You have to at some point tell it what cannot get to those important servers. Consider trying a:

Access-list 101 permit TCP host 134.33.0.0 140.40.0.0 0.0.255.255 eq 80
Access-list 101 permit TCP host 134.33.0.0 140.40.0.0 0.0.255.255 eq 53
Access-list 101 permit TCP host 134.33.0.0 148.52.0.0 0.0.255.255 eq 53
Access-list 101 permit TCP host 134.33.0.0 148.52.0.0 0.0.255.255 eq 3
Access-list 101 permit TCP host 134.33.0.0 148.52.0.0 0.0.255.255 eq 2
Access-list 101 deny IP host 134.33.0.0 140.40.0.0 0.0.255.555
Access-list 101 deny IP host 134.33.0.0 148.52.0.0 0.0.255.555
Access-list 101 permit IP any any

I am not sure if I have your source and destination addresses in the correct place. I am a little mixed up the way you phrased your problem, and it is 3:26 in the morning. Guess I need a can of Mountain Dew.

by mdl3

Got ya! by saying permit IP any any at the end of the statement I was permiting all IP trafic to the networks I was trying to block correct??
to permit HTTP,DNS,POP,Library only I needed to specify the deny IP to the destination networks,and than the permit IP any any to permit IP to every one else is this analogy correct? please feed back!
Thanks Mr. H very helpful!
MDL3

This discussion is closed to new replies.