Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to validate the building of a tool for managing Cisco ACL commands.

Thing is i'm using the aclcheck sintax validator (i dont own cisco equipament) with the following command do check

access-list 101 permit udp host EQ 80 host EQ 80 

My previous question helped me to correct errors in my tool but as far as i`ve researched this command should be right. A source host, source port, destination host and destination port filter, right?

OBS: Don`t bother about the addresses, they are just hypothetical, my tool only has to generate cisco commands in the right syxtax.


share|improve this question posting the URL of the software i`m using just in case you guys need some reference. – jaderanderson Jul 2 '10 at 2:14

The syntax is valid, however this access-list will rarely be useful. You typically just want to specify the destination port as requests will use a random source port for each connection. Try this:

access-list 101 permit udp host host eq 80

That will allow connections with any source port with a destination port of 80.

As far as not having any cisco equipment, if you can get your hands on an IOS image you can emulate it with GNS3

share|improve this answer
Yeah i know... weird that the syntax checker does`nt get it :S. Thanks for the tip of GNS3... that would be a awesome addition for demonstrating my project... too bad i got no time left for this. Final presentation is Saturday. Are you sure my command runs on IOS then? It it what i need to know so i can defend my project. Thanks again! – jaderanderson Jul 2 '10 at 3:44
That command is perfectly valid – Jason Berg Jul 2 '10 at 3:48

One thing that looks strange to me about the ACL is the UDP / port combo. Port 80 is implicity a TCP port. The effect of this ACL after considering the implicit deny any any is that all TCP port 80 traffic will be blocked if I'm not mistaken.

share|improve this answer
... No. There aren't any implicitly TCP or UDP port numbers. Is there a well-known application on TCP/80? Yep. Does that mean nothing can happen on UDP/80? No. – Bill Weiss Feb 2 '11 at 20:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.