1

enter image description here

This is what i am trying to do

Deny the network that host 200.200.200.10 is on, telnet access to R3
Permit host 200.200.200.10 to telnet to R3
Deny host 200.200.200.10 all access to host 204.10 on distant network
Allow everything else

This is what i have

access-list 100 deny tcp 200.200.200.0 0.0.0.255 host 203.203.203.2 eq 23 
access-list 100 permit tcp 200.200.200.10 0.0.0.0 host 203.203.203.2 eq 23
access-list 100 deny ip 200.200.200.10 0.0.0.0 204.204.204.10 0.0.0.0
access-list 100 permit ip any any

    Current configuration : 896 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1
!
!
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 200.200.200.1 255.255.255.0
 duplex auto
 speed auto
!
interface Serial0/0
 ip address 201.201.201.1 255.255.255.0
 ip access-group 100 out
!
router rip
 version 2
 passive-interface FastEthernet0/0
 network 200.200.200.0
 network 201.201.201.0
!
ip classless
!
ip flow-export version 9
!
!
access-list 100 deny tcp 200.200.200.0 0.0.0.255 host 203.203.203.2 eq telnet
access-list 100 permit tcp host 200.200.200.10 host 203.203.203.2 eq telnet
access-list 100 deny ip host 200.200.200.10 host 204.204.204.10
access-list 100 permit ip any any
!
no cdp run
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 password password
 login
!
!
!
end

I thought it would work but it doesnt? Any help would be appreciated.

4
  • Whether or not an ACL works also depends on where you apply it and in which direction you apply it. To explain where you went wrong, we need to see all that, too.
    – Ron Maupin
    Jul 22, 2018 at 0:29
  • @RonMaupin Here is the topology pasteboard.co/HvyCwOA.png. I am applying it to f0/0 on r1. Jul 22, 2018 at 0:32
  • Please edit your question to show the configuration. Simply show the configuration, copy it, and paste it into your question using the Preformatted-text feature. If we can see the actual ACL and where and how it is applied in the device, we can explain why it isn't working correctly.
    – Ron Maupin
    Jul 22, 2018 at 0:34
  • @ronmaupin I have added the running config of r1, thanks. Jul 22, 2018 at 0:40

1 Answer 1

0

You have a few problems.

You are using an extended ACL, which should normally be placed as close to the source as possible in order to prevent traffic destined to be dropped from wasting router resources. That would mean the you would want to apply the ACL inbound on interface FastEthernet0/0, not outbound on interface Serial0/0.

You can also run into problems by not including the no auto-summary command under your RIP configuration (for all the routers). It isn't really causing a problem with these addresses, but further subnetting or using different addresses can cause RIP to fail in a frustrating manner.

A big problem is that ACLs will start at the first line of the ACL, comparing the packet to each line in the ACL, and exit the ACL at the first match. That means when you deny the entire 200.200.200.0/24 network from being able to telnet to 203.203.203.2/32 on the first line, the next line allowing 200.200.200.10/32 to telnet to that host will never be evaluated because if it matches the second line, it would have matched the fist line and exited the ACL on the first line, dropping the packet. You must configure your permit statement first.

1
  • Thanks so much! Its working now. I was pulling my hair out for hours lol. Jul 22, 2018 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.