Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

http ports

can a http port opened in this way

access-list 110 permit tcp 10.80.122.13

eq 80 10.80.9.9 eq 80 instead of access-list 110 permit tcp 10.80.122.13 10.80.9.9 eq 80

4 REPLIES
Silver

Re: http ports

By specifiying this you are only allowing traffic originated from 10.80.122.13 with a source port of 80 and destined to 10.80.9.9 with a destination port of 80. This will normally not work as client browsers initiate a TCP session using a random port number greater than 1024 (ephemeral port range - implentation varies per OS). So while the destination of the packet is still port 80 (as web servers normally are listening on this port) the source port is never 80 (unless specifically requested by the application). So in short, no an http access-list entry should not be specified in the manner you have stated.

New Member

Re: http ports

you can do

access-list 110 permit tcp 10.80.122.13 gt 1023 10.80.9.9 eq 80

but no, port 80 is never a source port

New Member

Re: http ports

how to go about on using port for source

i guess for services like http,https,ftp,dns we can use gt 1023 or simply leave blank.

New Member

Re: http ports

Yes,an http port can be opened in this way subjected to host 10.80.9.9 always initiate http connection to 10.80.122.13 on port 80 i.e source port should always be 80 otherwise it won't connect.This you have to specify in the application i.e making the http connection on 10.80.9.9 otherwise don't specify source port and use access-list 110 permit tcp 10.80.122.13 10.80.9.9 eq 80.

95
Views
0
Helpful
4
Replies