Cisco Support Community
Community Member

Access-list Help

Hi Ciscoer,

I have 2 ethernet port on 2621 fa0/0( and f0/1( How to built access-list:

- All client on network can go to

- All client on network can only access and 56.2

And where should I apply the access-list --> on fa0/0 or fa0/1 in

This what I did but all the network cannot access to


access-list 102 permit ip host

access-list 102 permit ip host

access-list 102 deny ip

access-list 102 permit ip any any


Thanks In Advance



Re: Access-list Help

Hi hato,

your deny statement is blocking the return traffic of the sessions originated by to

If you want e.g. telnet to work from net 56 to net 64, you need to add

access-list 102 permit tcp eq telnet

before your deny statement. Idem for any other protocols.

Of course this opens up a security hole, e.g. a malicuous user could use source port 23 (telnet) to connect to the 56 subnet.

To avoid this, you can make the above statement more strict like this:

access-list 102 permit tcp eq telnet gt 1023

So even if a malicious user tries to connect with source port 23 he will only be able to connect to ports higher than 1023.



Community Member

Re: Access-list Help

Hi Hato

There are two issue involved in your access-list. I believe the DENY statement is blocking your 56 network to access 64 network. I believe, in theory, this should do what you want. But it will also depend on which interface you apply the access list. I would apply at fa0/0 with access IN


Re: Access-list Help

I dont think you can do it with a simple list like this. You want to unlimited access for one network to the other but the other is only allowed to talk to two hosts in the first network. So how can it respond to requests from the other hosts in that network?

You need to identify the traffic down to the ports that will be used and make use of the "established" tag in the access-lists. That way the second network will be able to respond to anyone but only open connections to the two hosts that are allowed.

Community Member

Re: Access-list Help

Hi thanks for the quick response,

ANy sample link for this? Or any sample config.


CreatePlease to create content