Access-list problems

[matthew.haydon]

I have a problem with access-lists that are applied to a interface cutting off all traffic to that interface. The sample access-list works fine on a 2600 but when applied to a 4000, it does the whole "cutting off traffic" thing. Any ideas?

Sample-

no access-list 102

access-list 102 permit ospf any any

access-list 102 permit udp any any

access-list 102 permit icmp any any

access-list 102 permit tcp any any eq 23

access-list 102 deny tcp any any neq 80

[pkhatri]

Matthew,

The only TCP traffic that this ACL will allow is telnet (tcp/23) traffic. All other TCP traffic will be dropped. Is that what your intent is ?

Also, what direction is the ACL applied in ? And is it applied to a WAN or a LAN interface ?

Paresh

[matthew.haydon]

The problem was that applying that particular access-list killed ping and telnet as well. As far I could tell there's no reason that should have happened unless there was a problem with the router. Very possible considering this is an abused 4000 series.

[pkhatri]

Would you be able to post the interface config of the interface you applied the ACL to ?

Paresh

[matthew.haydon]

Ethernet0 is up, line protocol is up

Hardware is Lance, address is 0000.0bfd.0bc2 (bia 0000.0bfd.0bc2)

Description: Internal Trusted Network

Internet address is 205.89.97.236/24

MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 5/255

Encapsulation ARPA, loopback not set, keepalive set (10 sec)

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output 00:00:00, output hang never

Last clearing of "show interface" counters never

Queueing strategy: fifo

Output queue 0/40, 0 drops; input queue 0/75, 20 drops

5 minute input rate 50000 bits/sec, 31 packets/sec

5 minute output rate 223000 bits/sec, 35 packets/sec

1424225 packets input, 334308744 bytes, 0 no buffer

Received 83071 broadcasts, 0 runts, 0 giants, 20 throttles

8 input errors, 0 CRC, 0 frame, 0 overrun, 8 ignored, 0 abort

0 input packets with dribble condition detected

1622361 packets output, 1237020069 bytes, 0 underruns

10180 output errors, 4167 collisions, 2 interface resets

0 babbles, 10180 late collision, 4057 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

[pkhatri]

I meant the configuration under Ethernet0, if you could pls post that...

Also, could you advise if ping/telnet works if the ACL is removed ?

Paresh