0

I am relatively new to learning networking

I've been trying some stuff out about "Access Lists" but seem to be confused at some point.

I am not able to deny a whole ip range from accessing another whole ip range..

is there any command in cisco routers that would allow me to do so? so far i've only been able to deny a specific ip range from accessing a single host ip, using:

"access-list 101 deny ip 192.168.2.0 0.0.0.255 host 192.168.1.0" 
"access-list 101 permit any any" 

and ofcourse assigning the access-group to the router interface.

I've searched the web but could not see anything of significance.


Thanks for the reply :)

I've actually tried it, but still didn't get what i need :/

The Scenario is that i have a router with 3 interfaces: fe0/0 connected to another router to an ISP network, fe1/0 connected to an internal switch with network 192.168.1.0/24 and fe2/0 connected to another switch of network 192.168.2.0/24.

What i need is that "to prevent the 192.168.2.0/24 network from accessing 192.168.1.0/24 network. when i applied the access list you gave me, all traffic from 192.168.2.0 got blocked by the router, there was no access to the ISP from the 192.168.2.0/24 network.

I applied the access list on the fe2/0 port as: ip access-group 101 in

what could be wrong or missing?

1 Answer 1

0

You are currently specifying a single host using the "host" parameter. Instead try this

Access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

This would deny all traffic from .2.0 to .1.0

http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

4
  • I have tried it but still did not get what i am looking for.. posted my situation as an edit to my question.
    – Abz Alzaza
    Dec 13, 2014 at 15:45
  • Apply it to fe1/0 out Dec 13, 2014 at 15:50
  • No problem. Feel free to mark an answer if it worked for you. Just to check, when you asked the access list the first time, did you add statements that allow traffic through to the web/router? If not, the implicit deny at the end of your access list would stop traffic Dec 13, 2014 at 19:33
  • Thanks I did :) yea guess i forgot to add the "permit ip any any" statement.. everything is fine now!
    – Abz Alzaza
    Dec 14, 2014 at 22:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .