Am I suppose to make a ACL entry like access-list Ex extended permit tcp <ip of subnet> <subnet mask> <ip of subnet that contains server> <subnet>
OR
access-list Ex extended permit tcp <ip of subnet> <subnet mask> <ip of server> <subnet>
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Feb 21, 2018 at 16:36
Add a comment
|
2 Answers
For a single server to be permitted you need the latter, the former permits the entire subnet.
Note that you don't use the subnet mask (unless you mean the entire subnet) but that ACLs use wildcards, ie. address bits that are to be ignored. So, a single server is <ip of server>/32 while <server subnet>/24 matches all IP addresses within a /24 range (whether this incidentally is your subnet range or not).
I'm going to assume the following:
internet -> Router/Firewall -> Webserver/Service(192.168.0.100)
access-list internetTOwebserver permit tcp any host 192.168.0.100 eq www
This would allow internet traffic to reach the Webserver on port 80 if the access list was applied to the outside interface of the router/firewall.
