Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Access-list not working properly??

Posted on 2004-08-04
7
280 Views
Last Modified: 2010-04-17
Hi,

I have created the following access-list;

access-list 110 permit tcp any host x.x.x.10 eq www
access-list 110 permit tcp any host x.x.x.10 eq 443
access-list 110 permit tcp any host x.x.x.10 eq 22
access-list 110 permit tcp any host x.x.x.12 eq smtp
access-list 110 permit tcp any host x.x.x.12 eq pop3
access-list 110 permit tcp any host x.x.x.12 eq 22
access-list 110 permit icmp any any unreachable
access-list 110 permit icmp any any echo
access-list 110 permit icmp any any echo-reply
access-list 110 permit icmp any any time-exceeded

access-list 115 permit ip any any

Then I applied them to my serial interface which is connected to my ISP

int s0
ip access-group 110 in
ip access-group 115 out

Problem:

The problem is in-coming works fine, and I can ssh in from external to x.x.x.10 and 12. And I can receive email. But for out-going traffic I cannot ssh out, I cannot surf the net and ping, and I cannot send emails. I'm using cisco 1700 with IOS Version 12.1(2). Both machines (10 and 12) are using public IPs.

Can anyone help me? Thanks

0
Comment
Question by:smw42
7 Comments
 
LVL 36

Accepted Solution

by:
grblades earned 150 total points
ID: 11724794
Add the following to the beginning of the access list
access-list 110 permit tcp any any established

Currently you are not permitting the reply packets to come back into the serial interface.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 11725183
You also need to permit dns replys back in.
Add this line also:

access-list 110 permit udp any eq domain any

0
 
LVL 1

Expert Comment

by:kuro2ck
ID: 11727093
Post the rest of your config then we can see all your nat statements too.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 28

Expert Comment

by:mikebernhardt
ID: 11731374
Why bother using access-list 115 at all if you're permitting everything? It has no effect on your question, which has already been well-answered. But no access-list and access-group is the same as what you have, but without the fuss.
0
 

Author Comment

by:smw42
ID: 11732766
access-list 115 was coz i could not get out going traffic,. so i just added that to test.

did not setup net. so my access-list shouldn't have much configuration

thanks.
0
 

Author Comment

by:smw42
ID: 11732770
did not set up nat i mean
0
 

Author Comment

by:smw42
ID: 11732802
how do i give points to the other answers too?? sorry i'm new to ee
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can Cisco resolve internet address internally 4 52
Radius Debug Error 16 103
EIGRP STUB 19 85
Best adsl router for small MS network 6 42
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question