Blocking MSN messenger in a Cisco 3640

[MJonkers]

Hi,

Does anyone know how I can block this app?

Could you please provide me with the IOS code for this.

access-list 9 deny 207.46.104.20 255.255.255.255?

Thanks

[jmia]

Hi Marc -

MSN Again... Well I've got c3640's as well with IOS 12.2(5a) running but I don't really use the c3640 to block IM services instead use PIX 515's, but in your case you can apply ACL's to deny MSN.

What you need to do is block port 1863 and IP range 64.4.13.0/24 on the c3640. For your information, here is a link that will explain thing's a little better:

http://testweb.oofle.com/messaging/MSN/index.htm

Hope this helps and let me know how you get on - -

[MJonkers]

Hi,

I tried this one but I' am still able to work with MSN messenger.

What can it be? I used the deny on the Dialer0 interface, which is the one where we connact to the internet

Thanks

[spremkumar]

hi

can u paste u r config here (ACL/dialer part)???

regds

prem

[MJonkers]

ACL:

access-list 102 deny udp any any eq rip

access-list 102 deny udp any any eq netbios-ns

access-list 102 deny udp any any eq netbios-dgm

access-list 102 deny udp any eq netbios-ns any

access-list 102 deny udp any eq netbios-dgm any

access-list 102 deny tcp any 64.4.13.0 0.0.0.255 eq 1863

access-list 102 permit ip any any

dialer-list 1 protocol ip permit

dialer-list 2 protocol ip list 102

Dialer part:

interface Dialer0

description Internet (Signet)

ip address negotiated

ip access-group 102 in

ip access-group 102 out

no ip directed-broadcast

ip nat outside

encapsulation ppp

no ip route-cache

no ip mroute-cache

dialer remote-name signet

dialer idle-timeout 300

dialer string 0676009900

dialer hold-queue 10

dialer load-threshold 80 either

dialer max-call 2

dialer pool 30

dialer-group 2

no peer default ip address

no cdp enable

ppp pap sent-username xxxxxxxx password 7 xxxxxxxxxxxxxxxxxxxx

ppp multilink

!

[spremkumar]

hi

r u using any type of proxy over thr for internet acces ??

regds

prem

[MJonkers]

Yes we use a Squid proxy (FreeBSD)

[jmia]

Hi again Marc,

Okay - you have the ACL applied. Two things you could try out -

1. Try placing the deny statement for MS Messenger with the port and IP address as the first ACL and see what happens.

2. If you have any Network monitoring tools, open up a session on for MS messenger and see which IP for MS messenger replies to your session and apply a block for that address / IP on the c3640. If you want a good and free network probe tool try using Ethereal. - http://www.ethereal.com

- Also as the previous post states, if you have a proxy, try denying the formentioned IP + port on the proxy as well.

Hope this helps --

[jmia]

Marc -

Here's a little more info on squid ACL's -

http://www.squid-cache.org/Doc/FAQ/FAQ-10.html

Hope it helps - -