Solved

Access-list not working properly??

Posted on 2004-08-04
7
278 Views
Last Modified: 2010-04-17
Hi,

I have created the following access-list;

access-list 110 permit tcp any host x.x.x.10 eq www
access-list 110 permit tcp any host x.x.x.10 eq 443
access-list 110 permit tcp any host x.x.x.10 eq 22
access-list 110 permit tcp any host x.x.x.12 eq smtp
access-list 110 permit tcp any host x.x.x.12 eq pop3
access-list 110 permit tcp any host x.x.x.12 eq 22
access-list 110 permit icmp any any unreachable
access-list 110 permit icmp any any echo
access-list 110 permit icmp any any echo-reply
access-list 110 permit icmp any any time-exceeded

access-list 115 permit ip any any

Then I applied them to my serial interface which is connected to my ISP

int s0
ip access-group 110 in
ip access-group 115 out

Problem:

The problem is in-coming works fine, and I can ssh in from external to x.x.x.10 and 12. And I can receive email. But for out-going traffic I cannot ssh out, I cannot surf the net and ping, and I cannot send emails. I'm using cisco 1700 with IOS Version 12.1(2). Both machines (10 and 12) are using public IPs.

Can anyone help me? Thanks

0
Comment
Question by:smw42
7 Comments
 
LVL 36

Accepted Solution

by:
grblades earned 150 total points
ID: 11724794
Add the following to the beginning of the access list
access-list 110 permit tcp any any established

Currently you are not permitting the reply packets to come back into the serial interface.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 11725183
You also need to permit dns replys back in.
Add this line also:

access-list 110 permit udp any eq domain any

0
 
LVL 1

Expert Comment

by:kuro2ck
ID: 11727093
Post the rest of your config then we can see all your nat statements too.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 28

Expert Comment

by:mikebernhardt
ID: 11731374
Why bother using access-list 115 at all if you're permitting everything? It has no effect on your question, which has already been well-answered. But no access-list and access-group is the same as what you have, but without the fuss.
0
 

Author Comment

by:smw42
ID: 11732766
access-list 115 was coz i could not get out going traffic,. so i just added that to test.

did not setup net. so my access-list shouldn't have much configuration

thanks.
0
 

Author Comment

by:smw42
ID: 11732770
did not set up nat i mean
0
 

Author Comment

by:smw42
ID: 11732802
how do i give points to the other answers too?? sorry i'm new to ee
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SNMP v3 Encryption of encoded messages 3 56
VLAN question 7 70
WAN Site Edge Routers 15 56
snmp-server enable traps gdoi ks-rekey-pushed 3 17
The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question