1

this is my network topology diagram:

Diagram

Networks that are outlined in the bottom are actually vlans 10, 20, 30, 40, 50 defined on switches S1 and S3. The routers R3 and R2 for the network have subinterfaces fa0/1.10, 20, 30, 40, 50 for vlans 10, 20, 30, 40, 50.

I'm working on access lists for router r3.

I want to permit access on port 2016 from host 192.168.2.2 to 192.168.1.2, and on port 2014 from host 192.168.1.2 to host 192.168.2.2.

This is what I have so far:

Extended IP access list 100
    10 permit tcp host 192.168.2.2 host 192.168.1.2 eq 2016 (38 matches)
    20 permit tcp host 192.168.2.2 host 192.168.1.2 eq 2016 established
    30 permit icmp any any (17 matches)

Extended IP access list 101
    10 permit tcp host 192.168.1.2 host 192.168.2.2 eq 2014 (3 matches)
    20 permit tcp host 192.168.1.2 host 192.168.2.2 eq 2014 established
    30 permit icmp any any (6 matches)

I applied them with following commands:

int fa0/1.30
ip access-group 100 in
int fa0/1.20
ip access-group 101 in

I tested it with netcat and found it does not work.

  • Can you be more specific about what isn't working? Also, you don't need line 20 in your ACLs -- they will never be used. – Ron Trunk Apr 24 '16 at 11:36
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 1:56
1
  1. ACL's on routers are not state-full as on Firewall's. What this means is that you need rules to allow traffic in both directions.

  2. TCP connections uses a well known port on the server side and normally selects a random port for the source of the connection.

Your requirements.

host 192.168.2.2 --> host 192.168.1.2:2016
and 
host 192.168.1.2 --> host 192.168.2.2:2014

Your Setup

int fa0/1.30 !Assume 192.168.2.0/24 subnet
  ip access-group 100 in
!
int fa0/1.20 !Assume 192.168.1.0/24 subnet
  ip access-group 101 in

ACL's:

Extended IP access list 100
10 permit tcp host 192.168.2.2         host 192.168.1.2 eq 2016 
20 permit tcp host 192.168.2.2 eq 2014 host 192.168.1.2 
30 permit icmp any any

Extended IP access list 101
10 permit tcp host 192.168.1.2 eq 2016 host 192.168.2.2
20 permit tcp host 192.168.1.2         host 192.168.2.2 eq 2014
30 permit icmp any any

Notes: Remember that the return traffic will also traverse the ACL on the interface where it enters.

| improve this answer | |
0

You may have your ports wrong for your applications. Try add." Permit ip any any log" generate the traffic than "show logging | inc 192.168.x.x" this will show you what's being permitted. Warning if this has lots of traffic this can cause high cpu on router. Than just add rules accordingly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.