cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
405
Views
10
Helpful
7
Replies

Extended Access List entry

edwardp
Level 1
Level 1

I have seen an extended access list entry in 2 different forms:

access-list 100 permit tcp any any eq telnet

and then like the next one with 'any' at the end of the statement

access-list 100 permit tcp any eq telnet

any

Kind of curious, why the 'any' at the end of the statement.

7 Replies 7

Jon Marshall
Hall of Fame
Hall of Fame

Edward

They are doing 2 different things.

The first line says

allow any host using any port to connect to any host on port 23

The second line says

allow any host using port 23 to connect to any host on any port.

The first line is the more common.

Jon

bmcginn
Level 3
Level 3

Mate,

In furtherance of what Jon has said:

access-list 100 permit tcp any any eq telnet

The 'access-list' word defines and ACL

the '100' identifies the ACL

the 'permit' is an ACL action

the 'tcp' (in conjunction with the permit) allows tcp traffic only

the first 'any' is the source address (ie any source address, as per Jon's post)

the second 'any' is the destination address (ie any destination address, as per Jon's post)

the 'eq' (short for equals) specifies a specific destination port

the 'telnet' is the destination port

access-list 100 permit tcp any eq telnet any

The 'access-list' word defines and ACL

the '100' identifies the ACL

the 'permit' is an ACL action

the 'tcp' (in conjunction with the permit) allows tcp traffic only

the first 'any' is the source address (ie any source address, as per Jon's post)

the 'eq' (short for equals) specifies a specific SOURCE port

the 'telnet' is the SOURCE port

the second 'any' is the destination address (ie any destination address, as per Jon's post)

The following page is a good reference for common Access-lists.

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml

Enjoy the ACL fun!!

Regards,

Brad

Brad

I believe that this is a good explanation and approaches the queestion in much the same way that I was thinking when I read the original post.

I believe that it is especially important to emphasize that the placement of eq telnet determines whether telnet is the source port (implying that this is traffic from the telnet server going back to the telnet client) or is the destination port (implying that this is traffic from the telnet client to the telnet server).

I rated your post as it deserved.

HTH

Rick

HTH

Rick

Thanks Rick..

I've been watching the netpro site for a bit and have seen your posts. I respect you and am proud to get such nice feedback from you. Thanks.

I see you're now a gold star.. well done and congrats.. lots of hard work went into that no doubt!

Speak to you round the traps.

Brad

"I believe that it is especially important to emphasize that the placement of eq telnet determines whether telnet is the source port (implying that this is traffic from the telnet server going back to the telnet client) or is the destination port (implying that this is traffic from the telnet client to the telnet server). "

Hmmm, i thought that was what i did :-)

Brad, agree with Rick, excellent explanation, rated.

Jon

Jon

While I agree with everything that you said, I felt that in your post the distinction between source port and destination port was implicit and Brad made it explicit. Trying to put myself into the position of the original poster who did not understand the functionality, I thought that making it explicit was a good thing.

HTH

Rick

HTH

Rick

Rick

No problem, it was said as much in jest as anything.

Jon

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco