2

I am trying to practice some scenarios on a GNS3 lab that i am doing on my spare time (just doing a very very basic firewall for now since this is new to me)

currently my scenerios I am trying to accomplish is

1. Allow SSH (tcp destined to port 22) from 
    10.0.0.0/8
    131.11.11.11/32 (fake ip)
   into my entire network (10.25.0.0/16). 

2  Disallow all other SSH (tcp destined to port 22) to MY network.
3  Allow all other traffic inbound to my network.

   and I am implementing this on my border routers

so in my cisco switch (my ABR is called R2) I am using this format for firewall that i found online

#SEQUENCENUM (permit/deny) PROTO SRCIPADDRESS SRCWILDCARD [OPERATOR] [PORT] DESTIPADDRESS DESTNETMASK [OPERATOR] [PORT]

I have in my 'show access-list'

Extended IP access list 100

100 permit tcp 10.0.0.0 0.255.255.255 host 10.25.0.0 eq 22

200 permit tcp host 131.11.11.11 host 10.25.0.0 eq 22

300 deny tcp any host 10.25.0.0 eq 22

400 permit ip any host 10.25.0.0

999 permit ip any 10.25.0.0 0.0.255.255

for 400 - would this be correct syntax to allow all other traffic inbound to my network?

and for 999 - I want to permit all other traffic (that is not tcp to port 22 to your network) is this correct?

thanks a bunch guys

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 14:57
2

Your "host 10.25.0.0" construct is wrong - you're referring to network here, not single host, so use "10.25.0.0 0.0.255.255" (inverse mask, without 'host' prefix) in 100, 200, 300 and 400. 999 is good.

| improve this answer | |
  • This... so hard... because I made this mistake tonight myself on a capture filter. The "host" keyword is a shortcut that automagically adds the mask "255.255.255.255" to the IP address that follows. – Smithers Apr 10 '15 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.