I am trying to practice some scenarios on a GNS3 lab that i am doing on my spare time (just doing a very very basic firewall for now since this is new to me)

currently my scenerios I am trying to accomplish is

1. Allow SSH (tcp destined to port 22) from (fake ip)
   into my entire network ( 

2  Disallow all other SSH (tcp destined to port 22) to MY network.
3  Allow all other traffic inbound to my network.

   and I am implementing this on my border routers

so in my cisco switch (my ABR is called R2) I am using this format for firewall that i found online


I have in my 'show access-list'

Extended IP access list 100

100 permit tcp host eq 22

200 permit tcp host host eq 22

300 deny tcp any host eq 22

400 permit ip any host

999 permit ip any

for 400 - would this be correct syntax to allow all other traffic inbound to my network?

and for 999 - I want to permit all other traffic (that is not tcp to port 22 to your network) is this correct?

thanks a bunch guys

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 14:57

Your "host" construct is wrong - you're referring to network here, not single host, so use "" (inverse mask, without 'host' prefix) in 100, 200, 300 and 400. 999 is good.

  • This... so hard... because I made this mistake tonight myself on a capture filter. The "host" keyword is a shortcut that automagically adds the mask "" to the IP address that follows. – Smithers Apr 10 '15 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.