Security

Ask something
Discussion Locked

ACL's

0 helpful
3 replies

by mdl3 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My questions is; in this ACL,
access-list 101 deny tcp
192.5.5.0 0.0.0.2 host 210.93.105.0 eq 23
access-list 101 permit tcp any any
this will block node 192.5.5.2 from telneting any body in network 210.93.105.0 rigth? ok it works, but i'm suposed to be able to ping any body in network 210.93.105.0 rigth? well i get destination unreachable message when i try to ping, i notice that whe i substitude the permit TCP for permit IP then i have a successful ping while bloking telnet, can somebody explain to me what that means and the difference between the two statements.
Thanks again!
MDL3

3 replies

by shanghai sam

The Protocol Type block of the IP header defines what kind of protocol a packet is. So if we do something like Permit TCP Any Any, we have specifically allowed all IP packets that are of Protocol Type number 6 or TCP. If you wanted to allow PINGs using this method, you could add another line to the ACL that was: Permit ICMP Any Any. These states allow all IP packets of Protocol Type number 1 or ICMP.

Therefore, by specifically stating TCP in your Permit statement you ruled out all of the other IP protocols like ARP, IGMP, and ICMP etc…. You correct this by allowing all IP Protocol Types with the Permit IP Any Any statement. If you look at all of the examples of ACL’s in a Cisco book, you will see that they usually end with a Permit IP Any Any. Hope this helped.

by mdl3

Thank u very much Aron H. your answer helped me, if i want to permit PING i need to state permit ICMP any any due to the fact that the statement permit TCP any any rules out the rest of the protocols of IP sute.
Thanks

This discussion is closed to new replies.