Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Cisco 1605-R

Posted on 2006-10-23
5
Medium Priority
?
315 Views
Last Modified: 2010-04-17
I have a 1605-R Cisco Router. I need to shrink my configuration.. I'm running Version 11.2

Here is what my config looks like

access-list 103 permit ip 10.0.0.1 0.0.0.255 host IP1
access-list 103 permit ip 10.0.0.1 0.0.0.255 host IP2
access-list 103 permit ip 10.0.0.1 0.0.0.255 host IP3
access-list 103 permit ip 10.0.0.1 0.0.0.255 host IP4

access-list 103 permit ip 10.0.0.21 0.0.0.255 host IP1
access-list 103 permit ip 10.0.0.21 0.0.0.255 host IP2
access-list 103 permit ip 10.0.0.21 0.0.0.255 host IP3
access-list 103 permit ip 10.0.0.21 0.0.0.255 host IP4

So i have this huge access list with random IPs which need to access the same 4 IPs. Is there anyway to create a group??

Thanks
0
Comment
Question by:inf2300
  • 2
5 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 17791894
>access-list 103 permit ip 10.0.0.1 0.0.0.255 host IP4
>access-list 103 permit ip 10.0.0.21 0.0.0.255 host IP1

Since 10.0.0.1 and 10.0.0.21 are both covered by mask 0.0.0.255, then
All you need is one set of 4 lines:

 access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP1
 access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP2
 access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP3
 access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP4




0
 

Author Comment

by:inf2300
ID: 17795346
Thanks for the reply...

I can't do that because it's punctual IPs that need access and not the entire range. For example i would need to access to 10.0.0.21, 10.0.0.36, 10.0.0.164. I know it would be very simple if i could put them in the same subnet but i can't. I don't control that network.

So is there anyway to create a group that would contain IP1, IP2, IP3 & IP4 so that i would only then have one line per 10.0.0.0 IP. This would shrink my config by 75%

Thanks
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 2000 total points
ID: 17795419
>access-list 103 permit ip 10.0.0.1 0.0.0.255 host IP4
Given the mask that you show here "0.0.0.255" you are already including the entire range of 10.0.0.0/24.
There is no value in continuing with it the way it is.

You would have to change it to:
access-list 103 permit ip host 10.0.0.1 host IP1
access-list 103 permit ip host 10.0.0.1 host IP2
access-list 103 permit ip host 10.0.0.1 host IP3
access-list 103 permit ip host 10.0.0.1 host IP4
access-list 103 permit ip host 10.0.0.21 host IP1
access-list 103 permit ip host 10.0.0.21 host IP2
access-list 103 permit ip host 10.0.0.21 host IP3
access-list 103 permit ip host 10.0.0.21 host IP4

Given this, and given that there is not way to create a group for acls in IOS (you can with PIX FW), your best bet may be to choose a shorter list of IPs to allow. Instead of inividual permits which allows all but a handful of hosts, how about the other way around - use a shorter list of deny and one permit:

access-list 103 deny ip host 10.0.0.13 host IP1
access-list 103 deny ip host 10.0.0.13 host IP2
access-list 103 deny ip host 10.0.0.13 host IP3
access-list 103 deny ip host 10.0.0.13 host IP4

access-list 103 deny ip host 10.0.0.22 host IP1
access-list 103 deny ip host 10.0.0.22 host IP2
access-list 103 deny ip host 10.0.0.22 host IP3
access-list 103 deny ip host 10.0.0.22 host IP4

access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP1
access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP2
access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP3
access-list 103 permit ip 10.0.0.0 0.0.0.255 host IP4


0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While it is possible to put two routes in place with the secondary having a higher metric, this may not always work. In the event of a failure that does not bring down the physical interface on the router the primary route is not removed. There is a…
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question