2

I have to set up and design a network as illustrated in:

enter image description here

I need to configure ACLs on inside interface and outside one. However, when I implemented the access-lists, the flow of traffic was affected and the internet connectivity was unavailable, and also external users could not access published services.

Could you please have a look on the configured ACLs and give me a clue about the issue? 

! This ACL gets applied to the interface interface which is connected to my LAN

ip access-list extended INSIDE_ACL_IN
permit ip 20.20.20.0 0.0.0.15 any
deny ip any any 


==========================================================================================
==========================================================================================

! This ACL gets applied to the Outside interface which is connected to my Internet provider


ip access-list extended OUTSIDE_ACL_IN

deny ip 127.0.0.0 0.255.255.255 any 
deny ip 255.0.0.0 0.255.255.255 any 
deny ip 224.0.0.0 31.255.255.255 any 
deny ip host 0.0.0.0 any 
deny ip 10.0.0.0 0.255.255.255 any 
deny ip 172.16.0.0 0.15.255.255 any 
deny ip 192.0.2.0 0.0.0.255 any 
deny ip 192.168.0.0 0.0.255.255 any 
deny ip 14.0.0.0 0.255.255.255 any 
deny ip 169.254.0.0 0.0.255.255 any 
deny ip 198.18.0.0 0.0.255.255 any 
deny ip 66.238.29.0 0.0.0.31 any 
deny ip 240.0.0.0 15.255.255.255 any
deny ip 162.16.0.0 0.15.255.255 any
deny 53 any any
deny 55 any any
deny 77 any any
deny pim any any
deny tcp any any eq bgp 
deny tcp any eq bgp any 
deny ipinip any any
deny gre any any
deny pim any any
deny 90 any any
deny ospf any any 
deny eigrp any any 
deny udp any eq rip any 
deny udp any any eq rip 
deny tcp any any eq 0 -input
deny udp any any eq 0 -input
deny tcp any any range 135 139
deny udp any any range 135 netbios-ss
deny udp any any eq snmp
deny udp any any eq snmptrap
deny tcp any any eq 445
deny udp any any eq 445
deny tcp any any eq 901
deny udp any any eq 901
deny tcp any any eq 1080
deny udp any any eq 1080
deny tcp any any range 1433 1434
deny udp any any range 1433 1434
deny tcp any any eq 1900
deny udp any any eq 1900
deny tcp any any eq 3389
deny udp any any eq 3389
deny tcp any any eq 5000
deny udp any any eq 5000
permit icmp any 10.1.1.0 0.0.0.255 echo-reply
permit icmp any 10.1.1.0 0.0.0.255 unreachable
permit icmp any 10.1.1.0 0.0.0.255 time-exceeded
permit icmp any 10.1.1.0 0.0.0.255 source-quench
permit icmp any 10.1.1.0 0.0.0.255 packet-too-big
permit icmp any 10.1.2.0 0.0.0.255 echo-reply
permit icmp any 10.1.2.0 0.0.0.255 unreachable
permit icmp any 10.1.2.0 0.0.0.255 time-exceeded
permit icmp any 10.1.2.0 0.0.0.255 source-quench
permit icmp any 10.1.2.0 0.0.0.255 packet-too-big
permit icmp any 10.1.3.0 0.0.0.7 echo-reply
permit icmp any 10.1.3.0 0.0.0.7 unreachable
permit icmp any 10.1.3.0 0.0.0.7 time-exceeded
permit icmp any 10.1.3.0 0.0.0.7 source-quench
permit icmp any 10.1.3.0 0.0.0.7 packet-too-big
permit icmp any 172.16.0 0.0.0.7 echo-reply
permit icmp any 172.16.0 0.0.0.7 unreachable
permit icmp any 172.16.0 0.0.0.7 time-exceeded
permit icmp any 172.16.0 0.0.0.7 source-quench
permit icmp any 172.16.0 0.0.0.7 packet-too-big
deny icmp any any fragments
deny icmp any any redirect
deny icmp any any
deny tcp any 192.168.1.0 0.0.0.255 eq 22 
deny tcp any 192.168.1.0 0.0.0.255 eq telnet 
deny tcp any 192.168.1.0 0.0.0.255 eq www 
deny tcp any 192.168.1.0 0.0.0.255 eq 443 
deny tcp any 192.168.1.0 0.0.0.255 eq 22 
deny tcp any 192.168.1.0 0.0.0.255 eq telnet 
deny tcp any 192.168.1.0 0.0.0.255 eq www 
deny tcp any 192.168.1.0 0.0.0.255 eq 443 
deny tcp any host 20.20.20.2  eq 22 
deny tcp any host 20.20.20.2  eq telnet 
deny tcp any host 20.20.20.2  eq www 
deny tcp any host 20.20.20.2  eq 443 
deny tcp any host 20.20.20.2  eq 22 
deny tcp any host 20.20.20.2  eq telnet 
deny tcp any host 20.20.20.2  eq www 
deny tcp any host 20.20.20.2  eq 443 
permit ip 10.1.0.0 0.0.255.255 10.1.0.0 0.0.255.255 
permit icmp 10.1.0.0 0.0.255.255 10.1.0.0 0.0.255.255
permit icmp 172.16.0 0.0.0.7 172.16.0 0.0.0.7
deny tcp any 66.238.29.0 0.0.0.31  fragments
deny udp any 66.238.29.0 0.0.0.31  fragments
deny icmp any 66.238.29.0 0.0.0.31  fragments
deny udp any any eq snmp
deny udp any any eq snmptrap
deny ip 192.0.2.0 0.0.0.255 any  
deny ip 4.0.0.0 0.255.255.255 any  
deny ip 69.254.0.0 0.0.255.255 any   
permit ip any 10.1.0.0 0.0.255.255
permit ip any 172.16.0 0.0.0.7 
deny ip any any log
Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 20:35

2 Answers 2

Reset to default
1

You didn't include the entire router configurations (you should really do that), but you seem to be confusing the in and out keywords on the INSIDE_ACL_IN configuration. The in and out keywords are from the perspective of the router, so applying the permit ip 20.20.20.0 0.0.0.15 any (it should really be for 20.20.20.0 0.0.0.3) ACL from the interface for the 10.10.0.0/29 network inbound to the router doesn't really make sense. It looks like you are trying to permit anything inbound from the 10.10.0.0/29 network with a source address in the 20.20.20.0/28 network, but deny everything else from that interface, which would deny traffic from the 10.10.0.0/29 network into the router from the network interface for that network.

You are using extended access lists, so you want to apply those as close to the source as possible.

Improve this answer
0

Is there a reason you blocked DNS port 53. If you are going to websites by name where does DNS get resolved? Without more information that's where I'd start. From there use your basic commands like ping and traceroute to see what and where it's blocked. You've denied a whole lot. Don't forget at the end of every ACL is a deny all even if you don't add it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.