Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Problem with ACL

Hi all,

My client has asked me to configure an access list that allows the SMTP and POP3 traffic from a specific address of his network to a foreign address, deny any other traffic between these 2 addresses and allow all other traffic. This is the configuration:

access-list 109 remark ACL Customer OUT
access-list 109 permit tcp host xxx.xxx.x.xx host xx.xxx.xxx.x eq smtp
access-list 109 permit tcp host xxx.xxx.x.xx host xx.xxx.xxx.x eq pop3
access-list 109 deny   ip host xxx.xxx.x.ss any
access-list 109 permit ip any any

interface GigabitEthernet0/0

ip access-group 109 out

The show access-list 109  shows me that is not working well. Someone knows the reason?

Thanks a lot

Customer#sh access-lists 109
Extended IP access list 109
    10 permit tcp host xxx.xxx.x.xx host xx.xxx.x.xx eq smtp
    20 permit tcp host xxx.xxx.x.xx host xx.xxx.x.xx eq pop3
    30 deny ip host xxx.xxx.x.xx any (2566 matches)
    40 permit ip any any (4945535 matches)

2 ACCEPTED SOLUTIONS

Accepted Solutions
Hall of Fame Super Blue

Re: Problem with ACL

emilio1973 wrote:

Hi all,

My client has asked me to configure an access list that allows the SMTP and POP3 traffic from a specific address of his network to a foreign address, deny any other traffic between these 2 addresses and allow all other traffic. This is the configuration:

access-list 109 remark ACL Customer OUT
access-list 109 permit tcp host xxx.xxx.x.xx host xx.xxx.xxx.x eq smtp
access-list 109 permit tcp host xxx.xxx.x.xx host xx.xxx.xxx.x eq pop3
access-list 109 deny   ip host xxx.xxx.x.ss any
access-list 109 permit ip any any

interface GigabitEthernet0/0

ip access-group 109 out

The show access-list 109  shows me that is not working well. Someone knows the reason?

Thanks a lot

Customer#sh access-lists 109
Extended IP access list 109
    10 permit tcp host xxx.xxx.x.xx host xx.xxx.x.xx eq smtp
    20 permit tcp host xxx.xxx.x.xx host xx.xxx.x.xx eq pop3
    30 deny ip host xxx.xxx.x.xx any (2566 matches)
    40 permit ip any any (4945535 matches)

It's difficult to say without understanding the topology but where is the source host in relation to gi0/0 ?  Are you sure you have applied the acl to

1) the right interface

2) the right direction on the interface

Jon

New Member

Re: Problem with ACL

There is a problem in the deny statement of the access list:

access-list 109 deny   ip host xxx.xxx.x.ss any

Will deny traffic to any other hosts too.  You need to replace this with:

access-list 109 deny ip host SRCIP host DSTIP

by behind Gi0 / 0 do you mean that g0/0 faces the foreign address?

by not working well what do you mean?  what are the results of testing connectivity?

you should use some addresses for client host and foreign host so we can better understand.

You may also want to write an access list to go "in" on the same interface to filter traffic coming from the foreign host.

3 REPLIES
Hall of Fame Super Blue

Re: Problem with ACL

emilio1973 wrote:

Hi all,

My client has asked me to configure an access list that allows the SMTP and POP3 traffic from a specific address of his network to a foreign address, deny any other traffic between these 2 addresses and allow all other traffic. This is the configuration:

access-list 109 remark ACL Customer OUT
access-list 109 permit tcp host xxx.xxx.x.xx host xx.xxx.xxx.x eq smtp
access-list 109 permit tcp host xxx.xxx.x.xx host xx.xxx.xxx.x eq pop3
access-list 109 deny   ip host xxx.xxx.x.ss any
access-list 109 permit ip any any

interface GigabitEthernet0/0

ip access-group 109 out

The show access-list 109  shows me that is not working well. Someone knows the reason?

Thanks a lot

Customer#sh access-lists 109
Extended IP access list 109
    10 permit tcp host xxx.xxx.x.xx host xx.xxx.x.xx eq smtp
    20 permit tcp host xxx.xxx.x.xx host xx.xxx.x.xx eq pop3
    30 deny ip host xxx.xxx.x.xx any (2566 matches)
    40 permit ip any any (4945535 matches)

It's difficult to say without understanding the topology but where is the source host in relation to gi0/0 ?  Are you sure you have applied the acl to

1) the right interface

2) the right direction on the interface

Jon

New Member

Re: Problem with ACL

hi Jon

Thanks for answering. The source IP address is on the internal network (behind Gi0 / 0). Your answer made me think that it should apply the access list on the ethernet interface (LAN) and sense input (IN). I will try it and now I discuss the results you.

Thanks
New Member

Re: Problem with ACL

There is a problem in the deny statement of the access list:

access-list 109 deny   ip host xxx.xxx.x.ss any

Will deny traffic to any other hosts too.  You need to replace this with:

access-list 109 deny ip host SRCIP host DSTIP

by behind Gi0 / 0 do you mean that g0/0 faces the foreign address?

by not working well what do you mean?  what are the results of testing connectivity?

you should use some addresses for client host and foreign host so we can better understand.

You may also want to write an access list to go "in" on the same interface to filter traffic coming from the foreign host.

317
Views
0
Helpful
3
Replies