bingboo
asked on
Cisco 1721 access-list and dns
ACCESS LIST:
access-list 100 permit tcp any xx.xx.xx.xx28 0.0.0.127 established
access-list 100 permit tcp any host xx.xx.xx.xx31 eq www
access-list 100 permit tcp any host xx.xx.xx.xx31 eq 443
access-list 100 permit tcp any host xx.xx.xx.xx31 eq 990
access-list 100 permit tcp any host xx.xx.xx.xx31 eq ftp
access-list 100 permit tcp any host xx.xx.xx.xx31 eq pop3
access-list 100 permit tcp any host xx.xx.xx.xx31 eq smtp
access-list 100 permit tcp any host xx.xx.xx.xx32 eq 1433
access-list 100 permit tcp any host xx.xx.xx.xx32 eq 6000
access-list 100 permit udp any eq domain host xx.xx.xx.xx80
access-list 100 permit udp any host xx.xx.xx.xx80 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx80 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx80 eq www
access-list 100 permit tcp any host xx.xx.xx.xx80 eq pop3
access-list 100 permit tcp any host xx.xx.xx.xx80 eq smtp
access-list 100 permit icmp any any
access-list 100 permit 47 any any
access-list 100 permit udp any any eq 4500
access-list 100 permit udp any any eq 500
access-list 100 permit tcp any any eq 50
access-list 100 permit esp any any
access-list 100 permit tcp any any eq 20
access-list 100 permit tcp any host xx.xx.xx.xx31 range 2900 3000
access-list 100 permit tcp any host xx.xx.xx.xx33 eq 3389
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 6001
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 6002
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 6004
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 443
access-list 100 permit udp any host xx.xx.xx.xx30 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx30 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx33 eq 1723
____
xx.xx.xx.xx80 and xx.xx.xx.xx30 are both DNS servers. However, 30 is failing unless I kill the entire access-list. Not very fluent in Cisco. I know port 53 is typically for DNS but when I do "access-list 100 permit udp any host xx.xx.xx.xx30 eq 53" it seems to look at that as the same as "access-list 100 permit udp any host xx.xx.xx.xx30 eq domain". So I would think that it should be working as is. It only functions when the entire list is killed - so I must be missing something.
Thank you.
access-list 100 permit tcp any xx.xx.xx.xx28 0.0.0.127 established
access-list 100 permit tcp any host xx.xx.xx.xx31 eq www
access-list 100 permit tcp any host xx.xx.xx.xx31 eq 443
access-list 100 permit tcp any host xx.xx.xx.xx31 eq 990
access-list 100 permit tcp any host xx.xx.xx.xx31 eq ftp
access-list 100 permit tcp any host xx.xx.xx.xx31 eq pop3
access-list 100 permit tcp any host xx.xx.xx.xx31 eq smtp
access-list 100 permit tcp any host xx.xx.xx.xx32 eq 1433
access-list 100 permit tcp any host xx.xx.xx.xx32 eq 6000
access-list 100 permit udp any eq domain host xx.xx.xx.xx80
access-list 100 permit udp any host xx.xx.xx.xx80 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx80 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx80 eq www
access-list 100 permit tcp any host xx.xx.xx.xx80 eq pop3
access-list 100 permit tcp any host xx.xx.xx.xx80 eq smtp
access-list 100 permit icmp any any
access-list 100 permit 47 any any
access-list 100 permit udp any any eq 4500
access-list 100 permit udp any any eq 500
access-list 100 permit tcp any any eq 50
access-list 100 permit esp any any
access-list 100 permit tcp any any eq 20
access-list 100 permit tcp any host xx.xx.xx.xx31 range 2900 3000
access-list 100 permit tcp any host xx.xx.xx.xx33 eq 3389
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 6001
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 6002
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 6004
access-list 100 permit tcp any host xx.xx.xx.xx80 eq 443
access-list 100 permit udp any host xx.xx.xx.xx30 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx30 eq domain
access-list 100 permit tcp any host xx.xx.xx.xx33 eq 1723
____
xx.xx.xx.xx80 and xx.xx.xx.xx30 are both DNS servers. However, 30 is failing unless I kill the entire access-list. Not very fluent in Cisco. I know port 53 is typically for DNS but when I do "access-list 100 permit udp any host xx.xx.xx.xx30 eq 53" it seems to look at that as the same as "access-list 100 permit udp any host xx.xx.xx.xx30 eq domain". So I would think that it should be working as is. It only functions when the entire list is killed - so I must be missing something.
Thank you.
ASKER
WAN interface.
That is complete ACL.
Everything functions perfectly with this ACL except DNS for server ending .X30 <-- which does work only if I remove the entire ACL
That is complete ACL.
Everything functions perfectly with this ACL except DNS for server ending .X30 <-- which does work only if I remove the entire ACL
ASKER
Could this be the cause:
access-list 100 permit udp any eq domain host xx.xx.xx.xx80
The reason why I ask this is because originally .x30 was the primary AD/DNS server - it went down for several weeks and was replaced with .x80 for AD/DNS, etc. The only way I could get .x80 to service requests was to change the above line in ACL. Doing so, however seems to have killed .x30 ability to service dns requests.
what is function of:
access-list 100 permit udp any eq domain host xx.xx.xx.xx80
access-list 100 permit udp any eq domain host xx.xx.xx.xx80
The reason why I ask this is because originally .x30 was the primary AD/DNS server - it went down for several weeks and was replaced with .x80 for AD/DNS, etc. The only way I could get .x80 to service requests was to change the above line in ACL. Doing so, however seems to have killed .x30 ability to service dns requests.
what is function of:
access-list 100 permit udp any eq domain host xx.xx.xx.xx80
ASKER
PLEASE DELETE QUESTION
Did you find a solution?
ASKER
I added:
access-list 100 permit UDP HOST <internet provider dns server ip address> eq domain any gt 1023
This works however, I am concerned that I might have just placed a patch on a larger problem as I did not have to enter this into the access list when I only had one DNS server.
Thoughts?
access-list 100 permit UDP HOST <internet provider dns server ip address> eq domain any gt 1023
This works however, I am concerned that I might have just placed a patch on a larger problem as I did not have to enter this into the access list when I only had one DNS server.
Thoughts?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Cut/paste all of existing acl 100 into Notepad
Edit to place the new acl entries in the correct order (before any deny)
Example:
\\-- remove from interface
interface serial 0/0
no access-group 100 in
\\-- delete acl
no access-list 100
\\-- re-create acl from top down
<paste edited acl 100>
\\-- re-apply to the interface
interface serial 0/0
access-group 100 in
permit udp any host x.x.x.x eq 53
\\-- is exactly same as, and will show in config as:
permit udp any host x.x.x.x eq domain