1
vote
0answers
43 views

How can I add ACL entry comments on a Cisco 3750?

I'm trying to find the best way to add comments into my access-lists. For the moment, the only maneer I found is the following one: switch#conf t switch(config)#ip access-list extended VLAN-TEST3 ...
4
votes
4answers
665 views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
1
vote
1answer
18 views

Is it possible to add description to cisco ACL?

I would like to add a description to cisco ACL. Something like: Permit all traffic from the R&D depatment to the lab. or Deny traffic from HA to R&D. Is it possible?
0
votes
1answer
77 views

Cisco IOS, restrict IP addresses per ethernet port #

I am configuring a Cisco 881, and am interested in restricting individual ports on the LAN (FastEthernet 0-3). I would like to be able to limit the IP addresses that someone can use based on which ...
-1
votes
1answer
82 views

Access Control Lists & DHCP

Please take a look at this image right here. In the image above you can see a virtual netwerk simulation program (CISCO Packet Tracer 6.0) where I'm trying to setup a network and secure it. However ...
-2
votes
1answer
102 views

Cisco Switch VLAN vs ACL [closed]

I am trying to create a VLAN in which my PS3 can access a remote PC that feeds it video. I want my PS3 not to be able to communicate to the internet, and be able to move that remote PC into the same ...
2
votes
2answers
125 views

How do I find where packets are coming from that are being blocked by an ACL?

I have an ACL to prevent regular workstations from accessing the management vlan on our switch. Every 5 minutes we get the following log entry: %SEC-6-IPACCESSLOGS: list mgtvlan-acl denied 0.0.0.0 ...
1
vote
1answer
148 views

Simple ACL not working

Network: Cisco 2921. Two subnets. 192.168.1.0/24 and 2.0/24. For some reason I can't get inter-subnet communication. I bound an ACL with the following statements to the inbound interface of each ...
0
votes
1answer
879 views

How to whitelist external access to an internal webserver via Cisco ACLs?

This is our company's internet gateway router. This is what I want to accomplish on our Cisco 2691 router: All employees need to be able to have unrestricted access to the internet (I've blocked ...
2
votes
2answers
732 views

Cisco IOS router config — how to disable SSH / SNMP on all but loopback address?

Sorry for the naive question; a quick reading of the cisco docs doesn't answer this question... So I've got a router (say for the sake of argument a 4500 running IOS 15.x) It has interfaces in 3 ...
1
vote
2answers
652 views

My facebook blocking ACL has stopped working

This probably very simple. This was setup before I arrived, and has been working to block facebook. I recently eliminated some static port forwarding on this 2691 (as in, I don't think anything else ...
0
votes
1answer
281 views

SFTP not connecting through Cisco 877 router

I am configuring a Cisco 877 router in a test environment. We use a non-standard port for SFTP, 3030. On my inbound ACL I am setting permit tcp any any eq 3030 but the remote SFTP connection is being ...
0
votes
1answer
297 views

How are these access lists interpreted by the router?

I'm puzzled because I can ssh into this router from 192.168.1.10, but not from 192.168.30.3 (as per acl 6). No interface mentions any of these access lists so am I correct in assuming these are global ...
1
vote
1answer
472 views

Automating Cisco ACL changes

I've recently started taking on more network management tasks to help our short staffed networking team. I'm very comfortable with network theory and have configured an number of IOS devices, but am ...
2
votes
1answer
202 views

Why do Access Control Lists in IP forwarding use an Inverse Mask?

While I was going through the concept of Access Control, I came upon the fact that ACLs use inverse masks. But while going through the explanation given in cisco site about Contrl lists, I noticed ...
1
vote
1answer
227 views

Cisco Extended ACL on 2811 Not Working Properly

I am almost positive this is an issue of missing a key component or not declaring/applying the ACL properly, but I am unable to figure out the fix on my own. What I am trying to do is only allow PC2 ...
1
vote
2answers
125 views

Controlling traffic on a small subnet

I have a small network with a business-class cable modem. I have a *.192/29 block assigned to the internal side of the modem. The first usable IP, .193, is assigned to the cable modem interface. I ...
0
votes
2answers
1k views

Cisco Route-Map Multiple ACL Match (Logical AND)

I'm having difficulty to configure a route-map with multiple matches in AND operation. The issue is, both match criteria are against ACL, but different ACL. What I want to do is route-map TEST ...
1
vote
1answer
437 views

Add Port Forward to ASA5505 with IPSEC Tunnel

I have an ASA 5505 on 8.2 in the field already working. It has two interfaces, LAN/inside and WAN/outside. There is an L2 site-to-site IPSec tunnel configured from the outside interface of the local ...
0
votes
1answer
125 views

Cisco 12.4 ACL with DHCP-obtained address

I figured this would be an easy one, but I've had a good amount of trouble finding this answer myself. I have a Cisco router that I'm setting up to have my Internet connection on one interface ...
0
votes
1answer
1k views

How does Cisco IOS ACL established flag work

You can permit outgoing packets, but then you need to permit the responses. One way is to permit any packet that is a followup to an established connection. access-list ??? permit tcp any any ...
1
vote
1answer
598 views

Filtering traffic into a Vlan in a Switched Network

I am designing a topology with one Core Switch and around 6 Edge Switches with around 10 Vlans managed through the VTP Server running on Core Switch. Inter Vlan routing is also enabled on the core ...
0
votes
2answers
183 views

Cisco Router ACL - permit one user to access all ports outgoing and incoming

The Cisco router ACL was configured by someone else. So what i want to do is i would like to give one user to access all ports incoming and outgoing. when i tried like this #access-list 101 permit ...
0
votes
2answers
2k views

How do I read ACL hit counters on a Cisco Catalyst 3560e switch?

I have a Cisco Catalyst 3560e switch, and I'm trying to learn how to work with ACLs. I've created a simple ACL and tested it by sending packets through the switch, and it seems to work. Some ...
1
vote
2answers
110 views

2 cisco 3560 switches (layer3)

I would like to create ACL to allow port 22, 80, 443 from outside and drop any other service . can you please explain to me how to do it?
1
vote
2answers
2k views

Cisco Catalyst 3550 Switch - VLAN ACL question

I can't seem to get Vlan ACLs to work properly. I want to be able to get to servers on the 10.100.x.x network as well as the 10.200.x.x network when I'm connected through the VPN. But, I want to ...
0
votes
2answers
2k views

Cisco IOS BVI ACL: Only allow established UDP

Related: Cisco IOS ACL: Don't permit incoming connections just because they are from port 80 I know we can use the established keyword for TCP.. but what can we do for UDP (short of replacing a ...
1
vote
2answers
296 views

Cisco IOS ACL types

The built in command help list displays access list types based on which range. router1(config)#access-list ? <1-99> IP standard access list <100-199> IP ...
0
votes
3answers
4k views

Cisco IOS: access-list logging rate-limited or missed packets

How do we fix these errors? 2629753: Dec 29 09:03:56.521 EST: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 2 packets This is a Cisco 871 router with BVI and access lists.
0
votes
1answer
279 views

Cisco IOS ACL: Don't permit incoming connections just because they are from port 80

I am going much based on my memory and I may not be correct on all of this. On a Cisco 851 (IOS) that uses a BVI or a bridge-route (the servers on the inside are configured with static and public IP ...
1
vote
1answer
168 views

managing and auditing existing cisco firewall access control and routing rules

I'd like to perform audit and maintenance of the existing cisco router and switch configuration before changing to the new ISP and implementing new VLAN features, how do you manage and audit your ...
0
votes
3answers
1k views

Can't connect to PPTP server outside of network

I'm trying to configure my Cisco 881 running IOS 15 to allow pptp connections to servers outside of the network. I know the PPTP server is configured correctly, because a)it's a clients VPN, and b) ...
0
votes
4answers
383 views

How to learn current ACLs on a Cisco router's interface

I want to add new ACL rules to a Cisco router. I have no previous experience with cisco. Many resources about Cisco acls have instructions on applying the acl rules to an interface. But I need to ...
0
votes
2answers
115 views

Cisco command wont work on syxtax checker

I'm trying to validate the building of a tool for managing Cisco ACL commands. Thing is i'm using the aclcheck sintax validator (i dont own cisco equipament) with the following command do check ...
0
votes
2answers
458 views

Syntax checker working crazy with cisco

I'm trying to verify only two commands for cisco IOS ACL Extendend. They are: access-list 101 deny any 192.168.0.0/23 any access-list 101 permit udp 192.168.1.1 any For this i`m using a ...
0
votes
1answer
2k views

Is it possible to do DNS-based ACLs on a Cisco ASA?

Short of using static IP addresses, is it possible to have a Cisco ASA use a DNS name rather than an IP address? For instance, if I want to limit a host in the DMZ to access only one particular web ...
0
votes
2answers
2k views

Can I Specify an Existing ACL using a Radius AV Pair?

I am able to specify access-lists for VPN users on my IAS radius server using avpairs like: Cisco-AVpair = "ip:outacl[#number]={standard-access-control-list | extended-access-control-list}" So for ...
0
votes
1answer
159 views

Cisco 877 ISR - Joining to another local network

At a remote site I have a Cisco 877 ISR providing network services (DHCP, DNS, internet, VPN back to base). I need to connect it to another companies LAN at the remote site to allow uses to print on ...
0
votes
2answers
3k views

ssh into Cisco router not working

On a 2800 series router, I used to be able to ssh in via two public interfaces, but now I can't seem to. One of these two public interfaces has an ACL, the other currently doesn't. When I ssh to the ...
3
votes
6answers
5k views

Cisco Firewall vs Cisco Router ACLs

What are the advantages of getting a dedicated firewall instead of, or in addition to, using ACLs and ip inspection on a router? I realize this might depend on the version of the router, are certain ...
1
vote
2answers
675 views

When are VLAN access maps actually applied to packets?

"Normal" ACLs are applied either inbound or outbound on an interface. However, I've come across a Cisco 6500 series layer 3 switch that uses VLAN access maps to filter traffic within its VLANs. It has ...
0
votes
5answers
322 views

Cisco PIX - What does this line do?

I found this line in among many other ACL lines in my PIX. It looks different than the rest of them. It's at the end of the rest of the ACL lines, including being after access-list acl-out deny ip ...
0
votes
5answers
174 views

Is there a way that could make interfacing with a our network's ACL easier?

At work we frequently have to alter our Access Control List (ACL), to block any computers with security violations until we can patch the problem. Currently we use a computer that is consoled into our ...