topic Re: Accesslist on pix 525 in Network Security https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255178#M566672 <HTML><HEAD></HEAD><BODY><P>It handles subnets fine but you have to use that syntax. Instead of "host subnet" you need "subnet subnet-mask". And from what you wrote about the purpose, I think you need to reverse the source/dest, assuming the ACL gets applied to the outside interface.</P><P></P><P>access-list acl_grp permit tcp theirsubnet subnet-mask gt 1023 host my-email-server eq smtp</P><P></P><P>HTH,</P><P>- Marty</P></BODY></HTML> Tue, 13 Apr 2004 17:18:56 GMT MARTY ADKINS 2004-04-13T17:18:56Z Accesslist on pix 525 https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255176#M566663 <P>I only want IP addresses on a specific subnet to be able tos end smtp traffic to my email server. I have tried the following access-lists but cannot get traffic to pass. </P><P></P><P>access-list acl_grp permit tcp host myipaddress host theirsubnet eq smtp and I reversed the order of the addresses. I am wondering if the access-list command does not recognize entire subnets? example: 209.165.201.0 ? </P> Fri, 21 Feb 2020 07:20:27 GMT https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255176#M566663 shawn.s 2020-02-21T07:20:27Z Re: Accesslist on pix 525 https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255177#M566668 <HTML><HEAD></HEAD><BODY><P>Maybe I wasn't clear enough.. I just want to create an access list that only allows hosts on a specified subnet to pass SMTP traffic to my email server. </P><P></P><P></P></BODY></HTML> Tue, 13 Apr 2004 12:03:09 GMT https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255177#M566668 shawn.s 2004-04-13T12:03:09Z Re: Accesslist on pix 525 https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255178#M566672 <HTML><HEAD></HEAD><BODY><P>It handles subnets fine but you have to use that syntax. Instead of "host subnet" you need "subnet subnet-mask". And from what you wrote about the purpose, I think you need to reverse the source/dest, assuming the ACL gets applied to the outside interface.</P><P></P><P>access-list acl_grp permit tcp theirsubnet subnet-mask gt 1023 host my-email-server eq smtp</P><P></P><P>HTH,</P><P>- Marty</P></BODY></HTML> Tue, 13 Apr 2004 17:18:56 GMT https://community.cisco.com/t5/network-security/accesslist-on-pix-525/m-p/255178#M566672 MARTY ADKINS 2004-04-13T17:18:56Z