Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

This seems fairly straight forward, though I'm having trouble finding a solution on Google and in the Cisco documentation. I think I'm perhaps just not looking for the correct thing.

Essentially I want to block all outgoing SMTP traffic except for our mail server, currently only the DHCP range is blocked, but I wanted to narrow that down to just the mail server.

Current:

access-list 107 deny   tcp 10.1.3.0 0.0.0.255 any eq smtp
access-list 107 permit ip any any

I tried (but completely locked out all network connections and required a power cycle):

access-list 107 deny   tcp any any eq smtp
access-list 107 permit tcp host 10.1.1.20 any eq smtp

So, I wish to block SMTP outgoing for all hosts except 10.1.1.20, how can this be done? What am I missing?

share|improve this question

1 Answer 1

Try this:

access-list 107 permit tcp host 10.1.1.20 any eq smtp
access-list 107 deny   tcp any any eq smtp
access-list 107 permit ip any any

Keep in mind, the order you insert a standard ACL in Cisco routers is the order in which the directives are matched.

So:

  1. First allow your server 10.1.1.20 to connect to smtp port
  2. Then disallow any other host to connect to smtp port
  3. Finally, allow any other IP communication
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.