1

So here is my config.

I want traffic coming from all networks except 172.23.1.0/24 to be blocked by inferface fa 0/0

So on the router I creater 2 ACLs

ACL 10

R1# access-list 10 permit 172.23.1.0 0.0.0.255

R1# access-list 10 deny any

ACL 101

R1# access-list 101 permit ip 172.23.1.0 0.0.0.255 10.10.10.0 0.0.0.255

Now I tried all the combination ip access-group 10 in after that ip access-group 10 out, after that ip access-group 101 in and finnaly ip access-group 10 out. All of these on interface fa 0/0 of R1.... But I can still ping hosts of 10.10.10.0/24 network with any body.

I'd like only host of 172.23.1.0/24 to be able to communicate with them... What did I do wrong here ?

Below is R1 Config

hostname R1
!
!
no ip cef
no ipv6 cef
!
!
username admin password 7 08204B471D1C09
!!
ip ssh version 1
ip domain-name mycorp.com
!!
!
interface FastEthernet0/0
 no ip address
 ip access-group 101 in
 ip access-group 10 out
 duplex auto
 speed auto
!
interface FastEthernet0/0.2
 encapsulation dot1Q 99
 ip address 10.10.10.3 255.255.255.0
 ip access-group 10 in
!
interface FastEthernet0/0.3
 encapsulation dot1Q 100
 ip address 10.100.100.3 255.255.255.0
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/0
 ip address 192.168.1.130 255.255.255.192
!
interface Serial0/1
 no ip address
 clock rate 2000000
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.129 
!
ip flow-export version 9
!
!
access-list 15 permit 10.10.10.0 0.0.0.255
access-list 15 deny any
access-list 10 permit 172.23.1.0 0.0.0.255
access-list 10 permit 10.10.10.0 0.0.0.255
access-list 10 deny any
!
!
line con 0
!
line aux 0
!
line vty 0 4
 access-class 15 in
 password 7 08204B471D1C09
 login
line vty 5 15
 access-class 15 in
 login local
!
!
!
end

So below is the image of my network. Only PC2 only should be able to communicate with PC1. PC3 should not BUT it does...

My network

3
  • You need to explain better what you are trying to do, and give us the router configuration so that we can see how it is actually implemented.
    – Ron Maupin
    Aug 1 '17 at 20:17
  • @RonMaupin My mistake Ron. I forgot there was sub interfaces at that interface...I'll remove that question... Aug 1 '17 at 20:22
  • @RonMaupin I could not resolve it after all. Please see my update to the question (don't mind the subif, I'll deal with that) Aug 1 '17 at 20:50
0

First, placing an ACL on an interface with no addressing, e.g. FastEthernet0/0, doesn't work.

Next, your ACL on FastEthernet0/0.2 is permitting traffic from 172.23.1.0/24 to come into the router from outside that interface, but there is no addressing in that network outside that interface. I'm not sure why you are permitting traffic from 10.10.10/24 in that interface because that is the on traffic that could possibly com into the interface. I don't think you want to apply the ACL to that interface.

Remember that standard ACLs should normally be applied as close to the destination as possible so that you do not block too much traffic, and extended ACLs should normally be applied to as close to the source as possible so that you don't route traffic unnecessarily. Also, remember that there is an implicit deny any at the end of an ACL.

I think your 172.23.1.0/24 traffic is coming into Serial0/0. If that is the case, then you want to do this:

Standard ACL

access-list 10 permit 172.23.1.0 0.0.0.255
!
interface FastEthernet0/0.2
 ip access-group 10 out
!

-or-

Extended ACL:

access-list 101 permit ip 172.23.1.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 101 deny ip any 10.10.10.0 0.0.0.255
access-list 101 permit ip any any
!
interface Serial0/0
 ip access-group 101 in
!
17
  • Hmmm this is strange...Now all hosts say destination host unreachable... Also why did you use the 3rd line (any any) ? If not from 172 Deny. (if ACL is sequential) Aug 1 '17 at 21:38
  • Did you clear all the ip access-group statements and delete the old ACLs first? Did the standard ACL work? Without the third line on the extended ACL, the only traffic that could flow through the router from that interface would be what is permitted in the first line. You probably want traffic from other networks to go other places.
    – Ron Maupin
    Aug 1 '17 at 21:43
  • Yup...I restarded the config...I though I had clear them all... So actually I should have been working on se 0/0.... Your help is greatly appreciated...I'm from stackoverflow any time you have a programming issue let me know Jason Krs Aug 1 '17 at 22:03
  • It depends. Standard ACLs should be placed as close to the destination as possible, so if the traffic leaves the router on FastEthernet0/0.2, the standard ACL should be placed outbound on that interface. Extended ACLs should be placed as close to the source as possible, so if the traffic comes into Serial0/0, the the extended ACL should be placed inbound on that interface. You only need to use one ACL.
    – Ron Maupin
    Aug 1 '17 at 22:07
  • Ron I have an issue with that config. Since we configure se 0/0 to block all so they cant reach 10.10.10.0 network, the machine in that network cannot telnet outside its network... (ping eith won't work. Se 0/0 ACL discard it)... I don't want them to reach 10 network but I want machines in 10 network to telnet them...How to do that ? Aug 2 '17 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.