Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Help in Access-List

Hi,

i want apply a access-list in my router to deny all client pc range ip address 10.1.1.11 to 10.1.1.50 any thing expecpt for UDP port permit and permit our managers pc ip addresses above this range. In my router I am using NAT and also telling me which interface I apply this access-list Ethernet or Serial

any Help is appreciated

9 REPLIES
Purple

Re: Help in Access-List

Hi,

Try this...

access-list 101 permit ip host 10.1.1.51 any

access-list 101 permit ip 10.1.1.52 0.0.0.3 any

access-list 101 permit ip 10.1.1.56 0.0.0.7 any

access-list 101 permit ip 10.1.1.64 0.0.0.63 any

access-list 101 permit ip 10.1.1.128 0.0.0.127 any

access-list 101 permit udp 10.1.1.11 0.0.0.0 any

access-list 101 permit udp 10.1.1.12 0.0.0.3 any

access-list 101 permit udp 10.1.1.16 0.0.0.15 any

access-list 101 permit udp 10.1.1.32 0.0.0.15 any

access-list 101 permit udp 10.1.1.48 0.0.0.1 any

access-list 101 permit udp 10.1.1.50 0.0.0.0 any

access-list 101 deny ip any any

!

! apply it inbound on your ethernet interface

interface ethernet 0

ip access-group 101 in

The first 5 lines will allow full access to all source addresses in the range 10.1.1.51 upwards. The next 6 lines will allow UDP to all source addresses from 10.1.1.11 to 10.1.150. The last line will deny everything else (not strictly required as it is the default).

Hope that helps - pls rate the post if it does.

Paresh.

New Member

Re: Help in Access-List

Hi Paresh,

thanks your help but for some mistake my network range start 10.213.169.1 netmask 255.0.0.0. I want block my first 50 network address for web browseing and any messanging. they only allow for sip voice traffic means sip port 5060 and rtp port range 6000 to 15000.my all other subnet also allow for voice traffic.Is this configuration is correct for this range.

Thanks

Purple

Re: Help in Access-List

When you say the first 50 network addresses, do you mean from 10.213.169.1 to 10.213.169.50 ?

Let me clarify your requirements:

- you want to restrict 10.213.169.1 to 10.213.169.50 so that only SIP and RTP traffic is permitted, everything else is blocked. Is that correct ?

- what traffic do you want to allow for all your other addresses ? Everything ?

Thanks,

Paresh

New Member

Re: Help in Access-List

Yes i want 10.213.169.1 to 10.213.169.50 with subnetmast 255.0.0.0 only SIP and RTP traffic permit, everything is blocke and all other ip addresses permit everything.

One more

I use NAT pool address in my router. so please give the configuration whose work in NAT.

thanks

Purple

Re: Help in Access-List

Howdy,

It might be an idea to post your router config so that we can cover all the aspects of this config.

Paresh,

Purple

Re: Help in Access-List

Hi again,

Try the following (it should work even if you have NAT configured);

access-list 101 permit udp 10.213.169.0 0.0.0.31 eq 5060 any

access-list 101 permit udp 10.213.169.0 0.0.0.31 any eq 5060

access-list 101 permit udp 10.213.169.32 0.0.0.15 eq 5060 any

access-list 101 permit udp 10.213.169.32 0.0.0.15 any eq 5060

access-list 101 permit udp 10.213.169.48 0.0.0.1 eq 5060 any

access-list 101 permit udp 10.213.169.48 0.0.0.1 any eq 5060

access-list 101 permit udp 10.213.169.50 0.0.0.0 eq 5060 any

access-list 101 permit udp 10.213.169.50 0.0.0.0 any eq 5060

access-list 101 permit udp 10.213.169.0 0.0.0.31 range 6000 15000 any

access-list 101 permit udp 10.213.169.0 0.0.0.31 any range 6000 15000

access-list 101 permit udp 10.213.169.32 0.0.0.15 range 6000 15000 any

access-list 101 permit udp 10.213.169.32 0.0.0.15 any range 6000 15000

access-list 101 permit udp 10.213.169.48 0.0.0.1 range 6000 15000 any

access-list 101 permit udp 10.213.169.48 0.0.0.1 any range 6000 15000

access-list 101 permit udp 10.213.169.50 0.0.0.0 range 6000 15000 any

access-list 101 permit udp 10.213.169.50 0.0.0.0 any range 6000 15000

access-list 101 deny ip 10.213.169.0 0.0.0.31 any

access-list 101 deny ip 10.213.169.32 0.0.0.15 any

access-list 101 deny ip 10.213.169.48 0.0.0.1 any

access-list 101 deny ip 10.213.169.50 0.0.0.0 any

access-list 101 permit ip any any

!

! apply it inbound on your ethernet interface

interface ethernet 0

ip access-group 101 in

Pls remember to rate posts.

Regards,

Paresh

New Member

Re: Help in Access-List

Hi,

i try these configuration they did work but one problem I use x-ten softphone with this configuration they did not work well. i use this proxy address voip-co2.teliax.com. When x-ten load they first check the ( Permorming DNS lookup then they try to registering this proxy address.

could u tell me how can i configure out these problem.

My aim is my all client PC only call they did not web surfing and any thing else. if any solution for expect router is kindly telling me.

thanks your big help

Purple

Re: Help in Access-List

Alright, try this now - I've added the ability for DNS queries to go through. Pls remember to rate posts that help.

access-list 101 permit udp 10.213.169.0 0.0.0.31 eq 5060 any

access-list 101 permit udp 10.213.169.0 0.0.0.31 any eq 5060

access-list 101 permit udp 10.213.169.32 0.0.0.15 eq 5060 any

access-list 101 permit udp 10.213.169.32 0.0.0.15 any eq 5060

access-list 101 permit udp 10.213.169.48 0.0.0.1 eq 5060 any

access-list 101 permit udp 10.213.169.48 0.0.0.1 any eq 5060

access-list 101 permit udp 10.213.169.50 0.0.0.0 eq 5060 any

access-list 101 permit udp 10.213.169.50 0.0.0.0 any eq 5060

access-list 101 permit udp 10.213.169.0 0.0.0.31 range 6000 15000 any

access-list 101 permit udp 10.213.169.0 0.0.0.31 any range 6000 15000

access-list 101 permit udp 10.213.169.32 0.0.0.15 range 6000 15000 any

access-list 101 permit udp 10.213.169.32 0.0.0.15 any range 6000 15000

access-list 101 permit udp 10.213.169.48 0.0.0.1 range 6000 15000 any

access-list 101 permit udp 10.213.169.48 0.0.0.1 any range 6000 15000

access-list 101 permit udp 10.213.169.50 0.0.0.0 range 6000 15000 any

access-list 101 permit udp 10.213.169.50 0.0.0.0 any range 6000 15000

access-list 101 permit udp any any eq domain

access-list 101 permit udp any eq domain any

access-list 101 deny ip 10.213.169.0 0.0.0.31 any

access-list 101 deny ip 10.213.169.32 0.0.0.15 any

access-list 101 deny ip 10.213.169.48 0.0.0.1 any

access-list 101 deny ip 10.213.169.50 0.0.0.0 any

access-list 101 permit ip any any

Hope that helps.

Regards,

Paresh.

New Member

Re: Help in Access-List

Hi Paresh,

thanks your big big corporation with this configuration I have done my goal. could u tell me some hits of how can make range of wild card mask.

thanks

205
Views
8
Helpful
9
Replies