3

Nagios is used from HOST1 to check the NTP server on HOST2. One of the servers resides in an ACL. The assumption was that

ip access-list extended vlanX
 permit udp host HOST1 X Y eq ntp
 deny   ip any any log
!

would allow the ntp response, but it results in:

re-sending request to peer 0
NTP CRITICAL: No response from NTP server

while executing the command on HOST2 works. It seems that the NTP has been blocked. How to allow it in the ACL? Note that the ACL works, as PING from specific hosts have to be explicitly allowed by adding new access rules.

  • 2
    Which direction (IN or OUT) did you apply it on the interface? Also, since you are logging denies, what message did you get in the log? – Ron Trunk Jan 19 '15 at 14:05
  • @Ron both (IN and Out as well). I will check the log. – 030 Jan 19 '15 at 14:11
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 4:30
2

If it's an inbound ACL then it's all right. But if you have applied same list to outbound traffic to interface, then it will result in dropping NTP responses back to your host. Your outbound ACL should look like

ip access-list extended ACL-Out
 permit udp X Y eq 123 host HOST1
 deny ip any any log
| improve this answer | |
2

You can make a reflexive ACL, which will allow the response packet to go through.

permit udp hosta hostb eq <port> reflect
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.