Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
362
Views
0
Helpful
3
Replies

ACL Help!

admin_2
Level 3
Level 3

‎02-23-2007 12:32 AM - edited ‎03-03-2019 03:53 PM

Dear All!

I have Cisco 2821 installed in my company. In this box

interface Serial0

ip address xxx.xxx.125.142 255.255.255.252

and the ISP has aloted 8 Ip pool for our server usages. that is xxx.xxx.125.144 255.255.255.248.

I want to impelement ACL on Serial 0 at with

ip access-group 115 in. And I want only required IP pool traffic out from serial interface and in last line don't want to right line ip permit any any. I want to implicite deny all other traffic. with this line access-list 115 deny ip any any.

I hope you will be understand what I actually want to implement in this ACL.

waiting your favaourable reply.

Labels:
0 Helpful
3 Replies 3

IWAN HOOGENDOORN
Level 1
Level 1

‎02-23-2007 12:38 AM

I don't understand your question ...

You want an outbound ACL for xxx.xxx.125.144 255.255.255.248 ?

So:

- what are the IP's that are allowed to talk to the inside?

- What are the IP's that are allowed to talk to the outside?

The ACL need to be implemented on S0

The ACL name has to be 115

#########################################

#If you find this post usefull

#please don't forget to rate this

#########################################

#Iwan Hoogendoorn

#CCIE#13084

#########################################

0 Helpful

royalblues
Level 10
Level 10
In response to IWAN HOOGENDOORN

‎02-23-2007 12:53 AM

friend,

You can use the following access-list

access-list 115 permit ip x.x.125.144 0.0.0.7 any

interface serial 0

ip access-group 115 out

This will allow traffic only from the subnet mentioned out of the interface. all other traffic will be implicitly denied.

HTH, rate if it does

Narayan

0 Helpful

Not applicable
In response to IWAN HOOGENDOORN

‎02-23-2007 01:44 AM

Dear Iwan!

As I have told we have public IP Pool:

You want an outbound ACL for xxx.xxx.125.144 255.255.255.248

I want these server which are using above IP Pool IP Out from Serial and can get any service e,g able to use internet and make vpn to head office. like this ACL line which will clear u all:

access-list 115 permit ip xxx.xxx.125.144 0.0.0.7 any

This host will be able to ping out side any machine.

access-list 115 permit icmp host xxx.xxx.125.148 any echo

access-list 115 permit icmp host xxx.xxx.125.148 any echo-reply

Only One Machine/Host on Branch office can ping my serial 0 IP address:

access-list 115 permit icmp host xxx.xxx.12.80 host xxx.xxx.125.142 echo

access-list 115 permit icmp host 2xxx.xxx.12.80 host xxx.xxx.125.142 echo-reply

access-list 115 deny ip 127.0.0.0 0.255.255.255 any

access-list 115 deny tcp any any eq 135

access-list 115 deny udp any any eq 135

access-list 115 deny tcp any any eq 137

access-list 115 deny tcp any any eq 138

access-list 115 deny tcp any any eq 139

access-list 115 deny tcp any any eq 445

access-list 115 deny tcp any any eq 593

access-list 115 deny udp any any eq 1434

access-list 115 deny tcp any any eq 4444

access-list 115 deny udp any any eq netbios-ns

access-list 115 deny udp any any eq netbios-dgm

access-list 115 deny udp any any eq netbios-ss

access-list 115 deny tcp any any eq telnet

access-list 115 deny udp any any eq tftp

access-list 115 deny icmp any any

access-list 115 deny ip any any

interface Serial0

ip access-group 115 in

if u want to any addtional information. U can ask.

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card