Results 1 to 2 of 2

Thread: Cisco access list problem

  1. #1
    Stu is offline
    Senior Member
    Join Date
    Jul 2003
    Vancouver, BC
    0 times in 0 posts

    Red face Cisco access list problem

    Calling all Cisco bods.

    Having a bit of a 'mare with this access list/security issue... any help appreciated!

    Have spent far too many hours over the past few days trying to get it to work, I am pretty sure the problem lies in me not understanding the wildcard masks correctly.

    Diagram of the network can be found here -

    The goal is to do the following:

    1) Prevent machines from within Boaz LAN ( from accessing anything other than fileserver 1.
    2) Machines on Center LAN can access anywhere on the network
    3) Routers can access anywhere

    The first thing I tried was to setup an extended ACL that denied all traffic unless its destination was the fileserver... and apply this to fa0/0 inbound on Boaz. ACL user:

    access-list 150 permit ip any host
    (access-list 150 deny ip any any)

    ip access-group 150 in

    This achieved goal 1 (machines on Boaz could not ping anything but the fileserver). However, only the file server could ping within the Boaz LAN .

    I also tried a number of other ACL’s based around the following:

    permit ip any host
    deny ip any
    permit any ip any

    The way I read the above is as follows. 1) Any traffic going to the fileserver is allowed. 2) Any traffic sourced within Boaz LAN (other than what was allowed by (1) ) is denied. 3) The remaining traffic (anything sourced from outside Boaz) is allowed to pass through the Ethernet port. (I.e. pongs initiated by WS2).

    However this did exactly the same, and again only fileserver 1 could ping within the LANs.

    Am I missing something blatantly obvious here guys?

    If anyone could help that would be awesome, as I'm pulling me hair out!


  2. #2
    Ex-MSFT Paul Adams's Avatar
    Join Date
    Jul 2003
    77 times in 59 posts
    • Paul Adams's system
      • Motherboard:
      • Asus Maximus VIII
      • CPU:
      • Intel Core i7-6700K
      • Memory:
      • 16GB
      • Storage:
      • 2x250GB SSD / 500GB SSD / 2TB HDD
      • Graphics card(s):
      • nVidia GeForce GTX1080
      • Operating System:
      • Windows 10 x64 Pro
      • Monitor(s):
      • Philips 40" 4K
      • Internet:
      • 500Mbps fiber
    I'm not a Cisco ACL expert, but I have experience with firewall configuration (and intend to be taking Cisco training in the future)...

    Is the problem that you are dropping ANY packet from the Boaz LAN other than (anything) to the file server - including replies to inbound connection attempts?

    Is there a way to tell the ACL that you only want to block [SYN] packets from Boaz machines, so new connections can't be established from those machines?
    (You will have to handle ICMP separately of course, with "permit icmp any any" or something.)

    Alternatively, block only connections from the Boaz LAN to destination ports <1024 (after the "permit traffic to file server 1" rule).
    ~ I have CDO. It's like OCD except the letters are in alphabetical order, as they should be. ~
    PC: Win10 x64 | Asus Maximus VIII | Core i7-6700K | 16GB DDR3 | 2x250GB SSD | 500GB SSD | 2TB SATA-300 | GeForce GTX1080
    Camera: Canon 60D | Sigma 10-20/4.0-5.6 | Canon 100/2.8 | Tamron 18-270/3.5-6.3

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. DVI problem, pc won't start! help needed.
    By snowwolf in forum Graphics Cards
    Replies: 1
    Last Post: 09-04-2010, 04:11 PM
  2. XFX 6800GT Problem
    By nvisage in forum
    Replies: 45
    Last Post: 07-08-2006, 12:28 AM
  3. VB.NET Compact Framework List View Problem
    By Spud1 in forum Software
    Replies: 1
    Last Post: 08-04-2005, 11:54 PM
  4. Very stange problem!
    By gobby in forum Help! Quick Relief From Tech Headaches
    Replies: 2
    Last Post: 28-08-2004, 05:20 PM
  5. weird cisco vpn problem!
    By scottyman in forum Help! Quick Relief From Tech Headaches
    Replies: 6
    Last Post: 15-06-2004, 10:35 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts