Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to validate the building of a tool for managing Cisco ACL commands.

Thing is i'm using the aclcheck sintax validator (i dont own cisco equipament) with the following command do check

access-list 101 permit udp host 192.10.05.233 EQ 80 host 225.193.43.235 EQ 80 

My previous question helped me to correct errors in my tool but as far as i`ve researched this command should be right. A source host, source port, destination host and destination port filter, right?

OBS: Don`t bother about the addresses, they are just hypothetical, my tool only has to generate cisco commands in the right syxtax.

Regards,

share|improve this question
    
techie.devnull.cz/aclcheck posting the URL of the software i`m using just in case you guys need some reference. –  jaderanderson Jul 2 '10 at 2:14
add comment

2 Answers

The syntax is valid, however this access-list will rarely be useful. You typically just want to specify the destination port as requests will use a random source port for each connection. Try this:

access-list 101 permit udp host 192.168.10.05.233 host 255.193.43.235 eq 80

That will allow connections with any source port with a destination port of 80.

As far as not having any cisco equipment, if you can get your hands on an IOS image you can emulate it with GNS3 http://www.gns3.net/

share|improve this answer
    
Yeah i know... weird that the syntax checker does`nt get it :S. Thanks for the tip of GNS3... that would be a awesome addition for demonstrating my project... too bad i got no time left for this. Final presentation is Saturday. Are you sure my command runs on IOS then? It it what i need to know so i can defend my project. Thanks again! –  jaderanderson Jul 2 '10 at 3:44
    
That command is perfectly valid –  Jason Berg Jul 2 '10 at 3:48
add comment

One thing that looks strange to me about the ACL is the UDP / port combo. Port 80 is implicity a TCP port. The effect of this ACL after considering the implicit deny any any is that all TCP port 80 traffic will be blocked if I'm not mistaken.

share|improve this answer
1  
... No. There aren't any implicitly TCP or UDP port numbers. Is there a well-known application on TCP/80? Yep. Does that mean nothing can happen on UDP/80? No. –  Bill Weiss Feb 2 '11 at 20:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.