Emiel Zwart
asked on
Cisco access-list for SIP traffic
Hi,
I want to add a Cisco access-list that only allow SIP traffic (5060) to a specific server.
Does this access-list do the job?
access-list 104 permit udp 5060 10.10.12.0 0.0.0.255 178.217.82.83 255.255.255.255 eq 5060
access-list 104 deny udp any any eq 5060
access-list 104 permit udp any any eq 5060
I want to add a Cisco access-list that only allow SIP traffic (5060) to a specific server.
Does this access-list do the job?
access-list 104 permit udp 5060 10.10.12.0 0.0.0.255 178.217.82.83 255.255.255.255 eq 5060
access-list 104 deny udp any any eq 5060
access-list 104 permit udp any any eq 5060
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
1) Cisco ACLs are being implemented by the router from top to bottom. If a packet matches one of the ACL lines, this packet will be processed accordingly and won't be compared to the lines below. Therefore your very last line would be useless since all udp packets except the ones in your first line would be denied before getting to your last statement. Also, if you switched the second and third line, then you'd be simply letting all udp traffic flow through so why bother writing your first line at all. So let's lose line three.
2) All access lists (as Predrag pointed out) have an implicit "deny ip any any" statement at the end. Which means your second line has no real meaning. So let's lose line two.
About 5061, it will only be used if you're using TLS, however I'm guessing you already know the port you need to open since you're asking for 5060 specifically.
Now, the access-list command itself has should be
access-list 104 permit udp 10.10.12.0 0.0.0.255 host 178.217.82.83 eq 5060
and not
access-list 104 permit udp 5060 10.10.12.0 0.0.0.255 178.217.82.83 255.255.255.255 eq 5060
The 5060 statement right after the protocol type does not make sense (to me at least). Also, ACLs need you to write down the subnet masks in reverse. Meaning 255.255.255.0 becomes 0.0.0.255 etc. 255.255.255.255 becomes 0.0.0.0. Also, when referring to a single IP, you can use the word host the way I did.
A last thing I should note. 5060 only opens up the signaling channel for SIP. Usually, you'll also need a range of udp ports for the actual voice traffic.