Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do access lists on cisco equipment block traffic Based on the protocol used (i.e. HTTPS) or port used (i.e. port 80)? I've read the instruction manual and I haven't seen a definitive answer.

When specifying what to block in each access list, the protocol name is used; however throughout the manual it discusses protocols one minute and ports the next.

I'm wondering if I change the port a protocol operates on, will the router allow the traffic through?

share|improve this question
On which equipment? an IPS module on a 6500 switch can behave very differently than basic switch, which will behave differently than an 2900 ISR – Rex Jan 10 '13 at 16:48
Thanks for your reply @Rex. I'm working with a Cisco 2811 router. I'm working with IP based (layer 3) access lists. – slickboy Jan 10 '13 at 17:05
Your would be better if you where more specific, or at least give some examples, about what you mean by protocol. For example, are you talking about protocols (ipv4, ipv6, ipx), or are you talking about application protocols (http, ftp, ssh, https, etc). – Zoredache Jan 10 '13 at 17:36
Thanks @Zoredache. Suggested change was made. – slickboy Jan 11 '13 at 11:43
up vote 1 down vote accepted

a IP access-group on an interface (i.e., ip access-group XXX in/out) uses names and port numbers interchangeably. I think you are trying to ask if the router can find HTTPS traffic on another port (port 777) and if you say 'block https', will this traffic be blocked? The answer to that is no - it only ever looks at the actual port number, specifying the name instead of the number is merely operator convenience to avoid you digging through the RFCs to find out what port a certain service is usually run on.

access-list 101 permit tcp host eq ?
  <0-65535>    Port number
  bgp          Border Gateway Protocol (179)
  chargen      Character generator (19)
  cmd          Remote commands (rcmd, 514)
  daytime      Daytime (13)
  discard      Discard (9)
  domain       Domain Name Service (53)
  drip         Dynamic Routing Information Protocol (3949)
  echo         Echo (7)
  exec         Exec (rsh, 512)
  finger       Finger (79)
  ftp          File Transfer Protocol (21)
  ftp-data     FTP data connections (20)
  gopher       Gopher (70)
  hostname     NIC hostname server (101)
  ident        Ident Protocol (113)
  irc          Internet Relay Chat (194)
  klogin       Kerberos login (543)
  kshell       Kerberos shell (544)
  login        Login (rlogin, 513)
  lpd          Printer service (515)
  nntp         Network News Transport Protocol (119)
  pim-auto-rp  PIM Auto-RP (496)
  pop2         Post Office Protocol v2 (109)
  pop3         Post Office Protocol v3 (110)
  smtp         Simple Mail Transport Protocol (25)
  sunrpc       Sun Remote Procedure Call (111)
  tacacs       TAC Access Control System (49)
  talk         Talk (517)
  telnet       Telnet (23)
  time         Time (37)
  uucp         Unix-to-Unix Copy Program (540)
  whois        Nicname (43)
  www          World Wide Web (HTTP, 80)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.