asked on

Access-Control List question regarding two networks

I have two networks divided by two Ethernet connections in my 1720 router. I know how to config the basics in my router and I know the command line but I am having a hard time understanding what i need to do to let my 10.0.0.0 network access only a few ip's on my 192.169.0.0 network. I have an access-list that consists of this:
_____
access-list 1 permit 192.168.0.0 0.0.255.255
access-list 1 permit 10.0.0.0 0.0.255.255
access-list 10 deny 10.0.0.0 0.0.255.255
access-list 10 permit any
access-list 101 permit tcp 192.168.0.0 0.0.255.255 any
no cdp run
_____

This access-list is not allowing the 10. network and 192 network to access each other which I want. But what I do need to do is allow a few ip's to talk across each network. So say I have a webserver and email server at address' 192.168.0.47 and 192.168.0.48 and a couple others. What would the rules be that I need to add to keep the wall there but just allow access to those two specific IP's? 192.168.0.47 & 48.

Thanks in advance!

Mike.

S3T

Mike,

From what you have written above there are 3 access lists on this router. 1, 10, 101.
you could implement an access-list somthing like the following.

access-list 111 permit ip 10.0.0.0 0.0.255.255 192.168.0.47 0.0.0.0
access-list 111 permit ip 10.0.0.0 0.0.255.255 192.168.0.48 0.0.0.0
access-list 111 deny ip 10.0.0.0 0.0.255.255 192.168.0.0 0.0.0.255
access-list 111 permit ip any any

This list would allow the 10.0.0.0 network to access only the two specified ip addresses on the 192.168.0.0 network. It will also not allow any other traffic to cross over from the 10.0.0.0 network into the 192.168.0.0 network but allow the 10.0.0.0 network to reach other networks. I hope that this helps you out a little. If there are any other specifications or circumstances please let me know. Thanks

S3T

kruptos

I belive you are on the right track, what I would do is use extended access for the control of traffic for the last part, it will allow you to provide the source AND destination in the access list.

Just remember to allow after you deny or your list will be worthless, and pay attention to what interface you are putting the lists on :-)

Let me know if you need more help!

kruptos

Nice answer S3T, maybe he will be cool and split the points :-) Great minds think alike :-)

anil_u

Here are some General access list rules:
- A packet is compared with each line of the access list sequentially.
- Once there is a match, there is no further checking down the access list.
- There is an implicit "deny" at the end of each access list.
- Types of access lists:
- Standard -- source IP only (TCP/IP), or source and destination IPX address (IPX). There is no port or protocol information.
- Extended -- source and destination IP, protocol field (Network Layer), port number (Transport Layer). IPX uses sockets instead of ports.
- Access lists can be inbound or outbound.
- You can only assign one access list per interface, per protocol, or per direction. Example -- only 1 inbound and 1 outbound IP access lists per interface.
- Keep more specific rules on top, and more general rules towards the bottom. Also, keep "deny" on top and "permit" towards the bottom.
- Any time a new entry is added, it will be placed at the end of the access list.
- You CANNOT remove a single line from an access list (unless it is named). Doing so will remove the whole access list. Copy the access list to a text editor and make changes there.
- You can disable the implied "deny" at the end of an access list with "permit any".
- Create access lists first and then apply them to an interface.
- Access lists filter traffic passing through the router. They will NOT filter traffic originating from the router.
- Place IP standard access lists as close to the destination as possible.
- Place IP extended access lists as close to the source as possible.
- Standard IP access lists -- (1-99) -- "config t", "access-list 10 deny host 172.16.30.2".
- Block a particular host -- "access-list 10 deny 172.16.30.5 0.0.0.0". Block a range of hosts (mask the last field) -- "access-list 10 deny 172.16.30.0 0.0.0.255".
- Block all IPs belonging to networks from "172.16.8.0" to "172.16.15.0" -- "access-list 10 deny 172.16.8.0 0.0.7.255" -- "7" is the wildcard -- always 1 less than the block size, which in this case is "8".
- Each block size must start at "0". Example -- for block size "8", we have "0-7", "8-15", "16-23", etc.
- "any" = "0.0.0.0 255.255.255.255".
- Standard IP access list example -- "config t", "access-list 10 deny 172.16.40.0 0.0.0.255", "access-list 10 permit any", "int e0" (closest to destination), "ip access-group 10 out".
- Controlling VTY (telnet) access -- "config t", "access-list 50 permit 172.16.10.3", "line vty 0 4", "access-class 50 in" -- ONLY allow "172.16.10.3" to telnet in.
- Extended IP access lists -- (100-199) -- "config t", "access-list 110 deny tcp any host 172.16.30.2 eq 23 log", "access-list 110 permit ip any any", "int e0", "ip access-group 110 out".
- Monitoring IP access lists:
- "sh access-lists" -- display all access lists. No interface information is shown.
- "sh access-list 110" -- only display a single access list.
- "sh ip access-list" -- display only the IP access lists.
- "sh ip interface" -- display which interfaces have access lists set.
- "sh run" -- displays access lists and also which interfaces have access lists set.
- IPX access lists:
- IPX standard -- (800-899) -- source and destination IPX address -- "config t", "access-list 810 permit 20 40", "int e0", "ipx access-group 810 out".
- IPX extended -- (900-999) -- "config t", "access-list 910 deny -1 10 0 20 0", "access-list 910 permit -1 -1 0 -1 0", "int e0", "ipx access-group 910 in" -- "-1" always means "all" in IPX.
- IPX SAP filters -- (1000-1099) -- "config t", "access-list 1010 permit -1 4 Sales" -- "-1" means "all source addresses", "4" is the destination, "Sales" is a description.
! There are two ways to finish setting up this SAP access list:
- "int e0", "ipx input-sap-filter" -- stops SAP entries from being added to the SAP table of the router.
- "int e1", "ipx output-sap-filter" -- stops SAP entries from being propagated out of the router.
- Verifying IPX access lists:
- "sh ipx interface" -- displays interface information and access list association.
- "sh ipx access-list" -- displays access list contents -- "FFFFFFFF" in the output means "any".