Edit Cisco ACL via Telnet?

Clarifications

To apply the access list to an interface you need to move into interface configuration mode for the specific interface you wish to apply the access list too.

Here is a good quick run down on ACL's http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

The T1 comes into either the ethernet0 or fastethernet0 .. direct or not i'm not sure .. but there are only two ethernet cables hooked up to the router.

when i do a 'show ip int' (where it lists the interfaces) it pops up with the ethernet0, fastethernet0, and serial0 interfaces. e0 and f0 are up, s0 is down, but i don't think we use the serial interface.

the access-list is just as you showed, and is created as extended access-list 102. just not sure where to bind it to as i don't quite understand how traffic flows from our network through the router as of yet.

what i do know is that e0 has an ip address of 64.x.x.x (which is the external ip assigned by the isp) and f0 has an internal ip address of 192.x.x.x (which is what we assigned). so knowing that, which is the "closest" to the inside?

do i want to bind group 102 to f0 out?

config t
int f0
ip access-group 102 out

?

another question.. this is the access-list that i have ready to go:

Extended IP access list 102
permit tcp host 192.168.1.112 any eq smtp
deny tcp any any eq smtp
permit ip any any

this says to me:

1) allow tcp traffic from on port 25

2) deny all tcp traffic on port 25

3) allow any tcp traffic over any other port

is that accurate? so basically no other machine on the network will be able to pass any packets on port 25 going out to the internet, but will be able to receive data coming from the internet into the network on port 25?

thanks for the help so far. my first time dealing with routers in this much detail. :)

Because thats what you are blocking, not SMTP traffic, the SMTP is a "short cut" and a mnemonic.
permit tcp host 192.168.1.112 any eq smtp
and
permit tcp host 192.168.1.112 any eq 25
are identical. No idea why your mail server would not be on 25, but there it is...
Also, E0 is your wan interface? With your internet connection wired to it?

The order of operations for Cisco IOS is as follows:
Inside-to-Outside

(1)If IPSec then check input access list
(2)decryption - for CET (Cisco Encryption Technology) or IPSec
(3)check input access list
(4)check input rate limits
(5)input accounting
(6)policy routing
(7)routing
(8)redirect to web cache
(9)NAT inside to outside (local to global translation)
(10)crypto (check map and mark for encryption)
(11)check output access list
(12)inspect (Context-based Access Control (CBAC))
(13)TCP intercept
(14)encryption
(15)Queueing

As you can see, NAT occurs before applying the outbound access-list. So by the time the traffic reaches the access-list, the IP address has been translated from 192.168.1.112 to a public IP and does not match the access-list.

Normally, you would have any public servers "static NAT'ed" to one of the public IP's. I would need to see more of the configuration to determine if you have that set-up or not.

Interesting post, and I was curious if something like that was going on.

Our Exchange Server is private and as far as I know, doesn't have a static ip address from our ISP.. we just have the one reserved for our router. Since this is the case, how am I going to allow traffic from our mail server?

I could be wrong, as I'm picking up this job from someone who is already far and gone and trying to piece together this puzzle that is our network on my own. :)

Yes, our internal mail server uses port 25 to send mail. :)

When I entered in the commands, I actually used 25 as the port number.. when I looked it up with the show ip int e0 command, it popped up with the smtp replacement which I thought was cutely annoying. :-P

In that case, to be sure I don't tell you something that would have unintended consequences, could you post the output of the "show run" command from your router? You can mask any usernames/passwords/Public IP addresses with asterisks. Then I will post the necessary changes.

NetMan

I was able to successfully telnet to that ip from the command prompt, and decided to try it out through the router just in case it might be important to know. Here were the results:

RouterSR>telnet 209.191.118.103 25
Trying 209.191.118.103, 25 ... Open

[Connection to 209.191.118.103 closed by foreign host]
RouterSR>

Results
NetMan

I was able to successfully telnet to that ip from the command prompt, and decided to try it out through the router just in case it might be important to know. Here were the results:

RouterSR>telnet 209.191.118.103 25
Trying 209.191.118.103, 25 ... Open

[Connection to 209.191.118.103 closed by foreign host]
RouterSR>

OK, now we're getting somewhere. If you can telnet from your email server to another email server's port 25 and it answers, then the smtp traffic is passing through the router OK. Has this email server been working previously? If so, has anything been changed on the server or the Exchange config?
When you try to send email does it bounce or stack up in the queue on the server? If it bounces, can you post the error message?

We've got her on the run now!

OK, now we're getting somewhere. If you can telnet from your email server to another email server's port 25 and it answers, then the smtp traffic is passing through the router OK. Has this email server been working previously? If so, has anything been changed on the server or the Exchange config?
When you try to send email does it bounce or stack up in the queue on the server? If it bounces, can you post the error message?

We've got her on the run now!

---------

NetMan,

You know, I looked at my monitors today and realized I have twelve remote desktop sessions open.. and it got me to wondering if I ran those telnet commands from the right server. Turns out, I did not. I ran it from one of the clients :-/

In fact, it seems there is a problem trying to open a telnet session to the yahoo mail servers as shown below:

direct fromm mail server:

421 Message from (64.00.00.00) temporarily deferred - 4.16.50. Please refer to h
ttp://help.yahoo.com/help/us/mail/defer/defer-06.html

Connection to host lost.

U:\>

through router:

RouterSR>telnet 209.191.118.103 25
Trying 209.191.118.103, 25 ... Open
421 Message from (64.00.00.00) temporarily deferred - 4.16.50. Please refer to h
ttp://help.yahoo.com/help/us/mail/defer/defer-06.html

[Connection to 209.191.118.103 closed by foreign host]
RouterSR>

To answer your questions and shed more light on the current situation, the mail server has been up and running for years before I came along. We're recently been running into a lot of spyware problems for various reasons, and have been blacklisted multiple times already. One of the things that I want to accomplish is to help prevent that from happening in the future is to prevent any client or server from sending traffic out to the internet through port 25, hopefully stopping a few naughty malware apps from e-mail itself (with the exception of the mail server, of course).

So, I wrote an ACL to handle that task (extended acl 102) and applied it to the outbound ethernet0 tunnel thing... whatever it's called... and unfortunately it seems that everything got blocked on port 25, even the mail server. As I can't have the entire office not able to send e-mail out, I had to remove the acl and that's where we're at right now.

When I did have the acl in effect, I noticed that while no e-mails would be sent, as soon as I re-booted the router (essentially refreshing the config to it's previous state) the e-mails I tried to send through finally went indicating that they were stacking up waiting to go through.

Thanks for all your help so far. It's beyond apreciated! :-)

The trick to the application of access-lists is to view the traffic from the router's perspective. Traffic originating on your local network(LAN) and destined for another subnet(such as the internet) first has to enter the router on it's LAN interface(in your case FastEthernet0). In other words it has to come IN on FastEthernet0. Then it has to go OUT on a different interface(in your case Ethernet0).
When the remote computer answers your traffic it first has to come IN on Ethernet0 and then OUT of FastEthernet0 to reach the computer on the LAN that originated the conversation.

In between coming in one interface and out another, the packets are processed by the router based on it's configuration and that's where the order of operations I posted earlier come into play. When you had the access-list 102 applied to Ethernet0 outbound, the outbound packets had already come IN on FastEthernet0 and been processed. One of those processes was NAT which happened before the access-list was consulted. NAT translated the IP Address from 192.168.1.112 to 64.00.00.XX. Next it got compared to access-list 102 from top to bottom. So:
(1)access-list 102 permit tcp host 192.168.1.112 any eq smtp - no match because it's ip address has already been translated to 64.00.00.XX
(2)access-list 102 deny tcp any any eq smtp - matches since any includes 64.00.00.XX.
And it drops the packet.

Your interface Serial0 is configured for a T1, however I believe you said nothing was connected to that port. So my bet is that your T1 terminates at an IAD(integarted access device) such as an AdTran which then connects to your router via Ethernet on router interface FastEthernet0. Possibly you can trace the cable from your routers FastEthernet0 and find out where it goes.

I see some additional things you might want to do regarding the router config. If you want to communicate outside the forum, let me know and we will talk offline.

Netman

Edit: After I submitted this, I realized my co-worker (bhymen) was logged on and it submitted under his name. Sorry about that. Netman

See reply above posted under bymen. I didn't realize he was logged on at my computer when I posted my reply. I'm sending him back to Huntsville!

Mine was set to disallow, but that has been changed. I still can't send a private message to you for some reason. If you still can't private message me, I can post a junk e-mail account that you can e-mail to, and we'll continue with our regular accounts from there.

That's very strange, I still can't send you a PM, you still can't send me a PM but I can send another member a PM. Don't know what's going on with that. Anyway, here's a yahoo.com email that I never use:
netman1958 at

send an email to that address with your real email address and I will contact you from my real email address and we will take it from there.

Cheers,
Netman