3

I am trying to limit access to our SIP servers to only 209.85.2.10 however, I am getting a little confused by the permit ip any any log. Will it not allow everything in? Without it, I loose all the rest of the needed traffic.

Question, how do I limit access to 5060 to only permit ip any any log and retain the rest of the traffic (ie, http, smtp..).

The permit ip any any log seems to contradict the constraint by allowing other servers to connect.

Internal Network

 interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip nat inside
 ip access-group 104 out
 exit

 ip access-list extended 104
 permit udp host 209.85.2.10 host 192.168.2.5 eq 5060 log
 permit ip any any log
 deny ip any any log
 deny tcp any any log
 deny udp any any log
 exit

Update

So I need to change the above to

 ip access-list extended 104
 permit udp host 209.85.2.10 host 192.168.2.5 eq 5060 log
 deny ip any host 192.168.2.5 log
 permit ip any any log
 exit

Then this will work as expected?

i) Accept 5060 access to 192.168.2.5 only from 209.85.2.10, and deny the rest of the attempts on the 5060 port ii) Let other traffic in from anywhere to anywhere within the network but 5060?

Update Final Product

For those who will find this post in the future. Here is the config that works for me thanks to the help of the two gentlemen in this thread.

ip access-list extended 104
permit tcp any host 192.168.2.5 eq 53
permit udp any host 192.168.2.5 eq 53
permit tcp any host 192.168.2.10 eq 25
permit tcp any host 192.168.2.10 eq 587
permit tcp any host 192.168.2.10 eq 993
permit tcp any host 192.168.2.10 eq 995
permit tcp any host 192.168.2.15 eq 80
permit tcp any host 192.168.2.15 eq 443
permit udp host 205.205.22.186 host 192.168.2.5 eq 5060
permit udp host 205.205.74.186 host 192.168.2.5 eq 5060
permit udp host 70.83.45.11 host 192.168.2.5 eq 5060
permit udp any host 192.168.2.20 eq 5080
permit udp any host 192.168.2.5 range 8000 65535
permit tcp any eq 25 host 192.168.2.10 range 1024 65535 established
permit tcp any eq 53 host 192.168.2.5 range 1024 65535 established
permit tcp any eq 53 host 192.168.2.10 range 1024 65535 established
permit tcp any eq 53 host 192.168.2.15 range 1024 65535 established
permit tcp any eq 53 host 192.168.2.20 range 1024 65535 established
permit udp any eq 53 host 192.168.2.5 range 1024 65535
permit udp any eq 53 host 192.168.2.10 range 1024 65535
permit udp any eq 53 host 192.168.2.15 range 1024 65535
permit udp any eq 53 host 192.168.2.20 range 1024 65535
permit tcp any eq 80 host 192.168.2.5 range 1024 65535 established
permit tcp any eq 80 host 192.168.2.10 range 1024 65535 established
permit tcp any eq 80 host 192.168.2.15 range 1024 65535 established
permit tcp any eq 80 host 192.168.2.20 range 1024 65535 established
deny ip any host 192.168.2.5 log
deny ip any host 192.168.2.10 log
deny ip any host 192.168.2.15 log
deny ip any host 192.168.2.20 log
permit ip any any
exit

ip nat inside source static 192.168.2.5 77.77.77.77 route-map voip-rtp extendable

Thanks in Advance,

Nick.

  • You really, really want to get rid of the log on the permit ip any any log statement. This will kill your router's performance and probably drive it's CPU utilization to unacceptable levels. Typically, you only want to log specific deny statements, if at all. – Ron Maupin Sep 13 '15 at 0:22
  • Hello Ron, the log messages are just for testing. I want to see the how the network packets get shaped and play nicely with the router. Once this is done, I will remove the log from accepts. One example is: : %SEC-6-IPACCESSLOGP: list 104 permitted udp 105.105.211.10(11180) -> 192.168.2.5(23854), 9746 packets This accept is a big deal for me. It's a port range accept on the udp. A hot topic these days.... ;) – Nick Cameo Sep 13 '15 at 0:31
  • As long as you understand that you may lose packets due to high CPU utilization on the router. I know someone who put log on everything, and he couldn't figure out why the performance was so bad. He was leaving the logging on to try to figure it out, but the logging itself was the cause of the problem. – Ron Maupin Sep 13 '15 at 0:34
  • Hahaha how elusive! I am just logging for debugging purposes. Once it's all figured out and traffic is flowing nicely both ways, i'll drop the logs. The logs were how I learned the ins and outs of ACL. – Nick Cameo Sep 13 '15 at 0:37
2

first of all
there is no host called 209.85.2.0 this is sort of network , you must configure it as a network not as a host

permit udp 209.85.2.0 0.0.0.255 host 192.168.2.5 eq 5060 log

second
you don't need
deny ip any any log
deny tcp any any log
deny udp any any log
cause the access list has its own explicate deny so in your case you just need to permit the type of access you want

third
you need to know that access list working by the concept of the first match where for example as you configured your access list that is mean ,When any one in 209.85.2.0 need to access host 192.168.2.5 ,this access list will allow only UDP access on port 5060 by its first line.

Then you have other 3 cases that won't match this line and will go to next ACL lines
1. Any network other than 209.85.2.0 need to access 192.168.2.5
2. Any one in network 209.85.2.0 need to access anything other than 192.168.2.5
3. Any one need to access any other network

your ACL second line means you will permit any one to access anything even 192.168.2.5 on port 5060.which is wrong . if you need to prevent any other network from access this host you just need to insert those 3 lines after your first line

deny ip any host 192.168.2.5 log

and then insert
permit ip any any log which will allow access to other servers from any where

| improve this answer | |
  • Thanks Gadlow. host 209.85.2.01 was a bad example. I just wanted to change the server ip for security reasons. Please see update – Nick Cameo Sep 12 '15 at 16:29
  • permit ip any any log which will allow access to other servers from any where, that is for services other than 5060 correct? – Nick Cameo Sep 12 '15 at 16:32
  • permit ip any any log will allow any thing to access any thing even 5060 , but for other hosts other than 192.168.2.5 – Gadeliow Sep 12 '15 at 16:39
  • Checking this and will mark your answer as correct. – Nick Cameo Sep 12 '15 at 16:42
  • You don't need these two lines (in your second example): deny tcp any host 192.168.2.5 log deny udp any host 192.168.2.5 log The line above deny ip any host 192.168.2.5 log will block TCP and UDP traffic (As well as ICMP) One other point: You may want to reconsider putting the "log" keywords on your permit statements. That causes the CPU be interrupted by each packet to process all the logging. Depending on the amount of traffic, it can put a heavy load on the router. – Ron Trunk Sep 12 '15 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.