Solved: configuring accesslist on cisco1841

donnie · ‎08-26-2010

Hi all,

I have a subsidiary office A that uses cisco1841 as the internet gateway. No access-list were applied to the internal or external interface. Now i need to allow a specific external ip from another office B to connect to 1 of my servers in office A.

I did a NAT as below to allow my server in office A to be accessible from external.

ip nat inside source static tcp 192.168.0.2 3389 84.1.2.1 3389 extendable

I then applied the below access-list 100 to my external interface of the router in office A which faces the internet.

access-list 101 permit tcp host 5.5.5.1 host 84.1.2.1 eq 3389
access-list 101 permit udp any any
access-list 101 permit icmp any any
access-list 101 permit tcp any any established

After the above is done, my internal network in office A could not access internet but could ping internet ip addresses.

What is wrong with the above accesslist? My objective is to restrict access to my server in office A to 5.5.5.1 only and to allow all outgoing traffic from my internal network in office A to the internet. Pls advise. Thks in advance.

Richard Burts · ‎08-30-2010

I am glad to know that adding the permit for TCP 53 was successful in resolving the issue with DNS.

There is an obvious explanation for why your VPN does not work once the access list is applied. For the IPSec VPN to work it requires 2 kinds of traffic to be permitted. It requires ISAKMP to negotiate the working keys which uses UDP port 500 by default. And this traffic would be permitted by your access list. The VPN also requires ESP which is IP protocol 50 to carry the encrypted traffic. And this traffic is being denied by your access list. So to fix it you should add a line to your access list which would look something like this:

access-list 101 permit esp host host

or you could simplify it to this:

access-list 101 permit esp any any

Give this a try and let us know how it works.

HTH

Rick

HTH

Rick

View solution in original post

Nagaraja Thanthry · ‎08-26-2010

Hello,

Can you please rewrite your access-list as below:

access-list 101 permit tcp host 5.5.5.1 host 84.1.2.1 eq 3389

access-list 101 permit udp any any

access-list 101 permit icmp any any

access-list 101 permit tcp any any established

access-list 101 permit tcp any any ack

access-list 101 permit tcp any any psh

Hope this helps.

Regards,

NT

donnie · ‎08-26-2010

Hi NT,

Thk you for your reply. With the accesslist that you advise i could telnet to external mail servers at port 25 but could not access internet. It seem to be some problem with the accesslist for dns portion as i can't ping fqdn but could ping public ip on the internet. PLs advise what else is missing. I applied the accesslist to my external interface via "ip access-group 100 in". No accesslist is applied to outbound traffic of my external interface. No accesslist applied to inbound and outbound traffic of my internal interface.

Nagaraja Thanthry · ‎08-26-2010

Hello,

I forgot to include the DNS part in the access-list. Please try the

following:

access-list 101 permit tcp host 5.5.5.1 host 84.1.2.1 eq 3389

access-list 101 permit udp any any

access-list 101 permit icmp any any

access-list 101 permit tcp any any established

access-list 101 permit tcp any any ack

access-list 101 permit tcp any any psh

access-list 101 permit udp any eq 53 any

Regards,

NT

Richard Burts · ‎08-26-2010

NT

Your responses are usually very good, so I wonder why you think that permit udp any eq 53 any will help when the second line of the access list is permit udp any any?

I wonder if it would help to add to the access list a permit for DNS using TCP:

permit tcp any eq 53 any

which would help if there were a need for a zone transfer or something like that.

HTH

Rick

HTH

Rick

Nagaraja Thanthry · ‎08-27-2010

Hello Richard,

Thanks for pointing that out. I was not looking clearly :). It has been a

hectic day. Anyways, I think the issue is not with the DNS traffic, but the

DNS server itself. Typically, (unless you have an internal DNS Server and

the internal DNS server has associations with external devices) nobody

implements TCP for DNS traffic. So, in this case, the best bet would be to

use a different DNS server (say 4.2.2.2) and see if that helps in getting

internet connectivity. That way, we could eliminate the DNS as the issue.

Once again, thanks for pointing that out.

Regards,

NT

Richard Burts · ‎08-27-2010

NT

No problem. I have had my share of hectic days and of times when I did not read a post quite as closely as I should have. We sympathesize and it is not a big deal.

I would agree that it might be helpful to try a different DNS server. But since we do not know how the network is set up for DNS (and since I believe that there are some circumstances where DNS for user request is transmitted using TCP) I thought it might be helpful to add a permit for TCP port 53. If the original poster tries a permit for TCP 53 and it helps then that is great. And if he tries it and it does not help then we know for sure that the problem is something else.

HTH

Rick

HTH

Rick

donnie · ‎08-29-2010

Hi Richard,

Thk you and apologies for late delay. After adding the accesslist with tcp 53 i am able to resolve domains. However my router also has a site to site vpn connection. After adding this accesslist the site to site vpn traffic do not seem to work. Name resolution is fine but site to site vpn traffic fail. Below is my config in addition to the accesslist we discuss abt. Pls advise thks in advance.

crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key test address 21.x.x.x
!
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto map test 10 ipsec-isakmp
set peer 21.x.x.x
set transform-set myset
match address 150(belong to the accesslist that were defined)
!
!
!
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$
ip address 10.10.0.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
duplex auto
speed auto
!
interface FastEthernet0/1
description $ETH-WAN$
no ip address
duplex auto
speed auto
pppoe enable
pppoe-client dial-pool-number 1
!
interface Dialer1
mtu 1492
ip address negotiated
ip nat outside
ip virtual-reassembly

ip access-group 101 in
encapsulation ppp
no ip mroute-cache
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname xxxxx
ppp chap password x yyyyyyyy

ppp pap sent-username testing password 7 3535353535353

crypto map test

ip nat inside source route-map nonat interface Dialer1 overload

access-list 101 permit tcp host 2.x.x.x host 6.x.x.x eq 1433
access-list 101 permit udp any any
access-list 101 permit icmp any any
access-list 101 permit tcp any any established
access-list 101 permit tcp any any ack
access-list 101 permit tcp any any psh

access-list 101 permit tcp any eq 53 any

access-list 110 deny ip 172.16.9.0 0.0.0.255 172.16.5.0 0.0.0.255
access-list 110 permit ip 172.16.9.0 0.0.0.255 any
access-list 120 permit ip 172.16.9.0 0.0.0.255 172.16.5.0 0.0.0.255
dialer-list 1 protocol ip permit

route-map nonat permit 10
match ip address 110

Richard Burts · ‎08-30-2010

I am glad to know that adding the permit for TCP 53 was successful in resolving the issue with DNS.

There is an obvious explanation for why your VPN does not work once the access list is applied. For the IPSec VPN to work it requires 2 kinds of traffic to be permitted. It requires ISAKMP to negotiate the working keys which uses UDP port 500 by default. And this traffic would be permitted by your access list. The VPN also requires ESP which is IP protocol 50 to carry the encrypted traffic. And this traffic is being denied by your access list. So to fix it you should add a line to your access list which would look something like this:

access-list 101 permit esp host host

or you could simplify it to this:

access-list 101 permit esp any any

Give this a try and let us know how it works.

HTH

Rick

HTH

Rick

donnie · ‎08-31-2010

Hi Richard,

Finally my problem is solved. Thk you very much!!

Richard Burts · ‎08-31-2010

I am glad that you have your problem solved and that our suggestions helped to achieve this. Thank you for using the rating system to indicate that your problem was resolved (and thanks for the rating). It makes the forum more useful when people can read about a problem and can know from the rating that there were suggestions that did lead to a solution.

HTH

Rick

HTH

Rick