2

I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).

Using NMAP, the client is able to find my open port on my network host(137). So I implemented an ACL on my router using the command.

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any

What I wanted to do is to make sure that the moment the client uses NMAP to scan my network host for the port, port 137 will be filtered instead of open because of the ACL configured, however, the client is unable to even ping my network host now unless I add another command, permit ICMP any any, in the ACL.

Why is this so? Can any experts shed light about this?

  • and where did you apply this access-list? – Teun Vink Oct 23 '15 at 9:38
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 20:05
4

There is an implicit "deny" at the end of every access-list. So your current access-list actually says:

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
access-list 111 deny ip any any

This means any UDP traffic (except from the client to port 137) is allowed, but all other traffic on that interface (including TCP and ICMP) is dropped. What you're looking for is this:

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit ip any any

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.