0

How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow for telnet packets from a telnet server with any source address going to any destination?

enter image description here

0
0

allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address)

permit udp <LANIPaddress> <LANIPwildcard> <DNSIPaddress> 0.0.0.0 eq 53
permit tcp <LANIPaddress> <LANIPwildcard> <DNSIPaddress> 0.0.0.0 eq 53

ping from a host PC (IP address) to any destination

permit imcp <hostPCaddress> 0.0.0.0 any echo

allow for telnet packets from a telnet server with any source address going to any destination

permit tcp any eq 23 any

Depending on where exactly you apply the rules, you might also require ACL rules for their reverse directions. Don't forget that an ACL denies/filters everything without an explicit permit.

6
  • If the LANIPaddress is 192.1.1.0, is the LANIPwildcard 10.0.0.1 OR 0.0.3.255? Is it both? Sep 23 at 18:34
  • The wildcard is the inverse (ones' complement) of a subnet mask if you use it with subnets. For e.g. a /20 subnet you'd use 0.0.15.255 as wildcard. In contrast to subnet masks, wildcard bits don't have to be contiguous. Any wildcard bit that is set makes the according address bit match either 0 or 1.
    – Zac67
    Sep 23 at 18:59
  • Also, if I wanted to allow SSH from any source address to another router's fa0/0 address and include an ACE on line 800 that will deny all other IP traffic, how would I do that? @Zac67 Sep 25 at 3:45
  • Denying all other IP traffic doesn't require anything. It's the default, implied final ACE in any ACL. SSH uses TCP port 22, just replace that in the above examples.
    – Zac67
    Sep 25 at 3:51
  • One last thing, how would I edit the ACL to match packets from a host PC (IP address) to access the server on 2 TCP ports? Sep 25 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.