2

I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).

Using NMAP, the client is able to find my open port on my network host(137). So I implemented an ACL on my router using the command.

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any

What I wanted to do is to make sure that the moment the client uses NMAP to scan my network host for the port, port 137 will be filtered instead of open because of the ACL configured, however, the client is unable to even ping my network host now unless I add another command, permit ICMP any any, in the ACL.

Why is this so? Can any experts shed light about this?

Improve this question
2
  • and where did you apply this access-list?
    – Teun Vink
    Commented Oct 23, 2015 at 9:38
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 12, 2017 at 20:05

1 Answer 1

Reset to default
4

There is an implicit "deny" at the end of every access-list. So your current access-list actually says:

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
access-list 111 deny ip any any

This means any UDP traffic (except from the client to port 137) is allowed, but all other traffic on that interface (including TCP and ICMP) is dropped. What you're looking for is this:

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit ip any any
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.