2

I'm trying to create an acl for use with a nat but I can't get the deny statements working.

All hosts on a private network should be accessible, except from a server which should not be accessible from anywhere but 192.168.10.0 and 192.168.11.0. The router reaches out to an ISP (203.1.1.4) via the IP: 203.1.1.5

This is what I have so far for the acl:

ip access-list extended acltest
remark Prevent server from reaching outside NAT
deny ip 192.168.10.20 0.0.0.0
remark Allow access for other hosts on the networks
permit ip 192.168.10.0 0.0.0.255 any
permit ip 192.168.11.0 0.0.0.255 any

Doing this I get a message about incomplete statements.

I have also tried doing:

deny host 192.168.10.20

...but this returns an "invalid input" message at the start of 'host'.

After checking the list, the permit statements go through but the deny one doesn't. What am I doing wrong with the list? Thanks.

1

You are using only a source address for the deny in your extended access list (like a standard access list), but an extended access list has both the source and destination address. You do not need an extended ACL for NAT.

A standard ACL should work:

access-list 10 deny host 192.168.10.20
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 10 permit 192.168.11.0 0.0.0.255
!

Also, your next attempt forgets to use the protocol (ip) that an extended ACL requires.

  • It worked after I changed everything to a standard list. I did, however, try and use the extended list, by simply adding 'ip' before the 'host' keyword (on the second attempt). This didn't end up working. Is it because I didn't specify the destination address? Thanks. – zusumifa Apr 14 at 5:24
  • Yes. Extended ACLs require the protocol, source, and destination. I really do not see a reason to use a NAT extended ACL if your destination is any. – Ron Maupin Apr 14 at 13:24
1

In extended ACLs, the correct syntax is

deny ip <source-ip> <source-wildcard> <destination-ip> <destination-wildcard>

so you'd need at least

deny ip 192.168.10.20 0.0.0.0 0.0.0.0 255.255.255.255

or shorter

deny ip 192.168.10.20/32 any

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.