topic Re: Access-list correct? in Network Security

Access-list correct?

Scott Payne — Mon, 11 Mar 2019 19:35:19 GMT

Hello everyone!

I am working on locking down the access to the internet and wanted to do a quick test. Below is my config with the new line of code in bold. I am trying to block specific ports while allowing everything else.

My question is: "Will this work?"

access-list 101 extended permit tcp host 10.1.5.80 any eq smtp
access-list 101 extended permit tcp host 10.1.5.91 any eq smtp
access-list 101 extended permit tcp host 10.1.5.50 any eq smtp
access-list 101 extended deny tcp any any eq smtp
access-list 101 extended deny tcp any any range 1495 - 2597
access-list 101 extended permit ip any any

Thanks,

Scott

Re: Access-list correct?

Nagaraja Thanthry — Fri, 14 Jan 2011 17:53:35 GMT

Hello,

So, the three devices (.80/91/50) are your mail servers that will be talking to external mail servers. Is that correct? Also, what device you are implementing this access-list on? If it is on a dedicated firewall (PIX/ASA), this should work fine. If you are doing it on a router, then you might need to make sure that none of the servers are being contacted by the external clients using source port in the range of 1495 - 2597.

Hope this helps.

Regards,

Re: Access-list correct?

Scott Payne — Fri, 14 Jan 2011 17:59:30 GMT

This is on an ASA 5520. And I am only trying to block a range of ports for testing. Once everything starts to look correct, I was planning to remove the ip any any statement and just add permit statements for the specific ports. I did this range so i could try and break internet messenger as a test. We have no devices utilizing these ports.

If I am understanding correctly, I see that it should successfully block IM traffic and allow everything else.

Re: Access-list correct?

Dan-Ciprian Cicioiu — Fri, 14 Jan 2011 18:01:53 GMT

If you want to block all the TCP flows with the dst port 1495 - 2597 :

- remove the "-" between the range

access-list 101 deny tcp any any range 1495 2597

Dan

Re: Access-list correct?

Dan-Ciprian Cicioiu — Fri, 14 Jan 2011 18:05:02 GMT

You might try using NBAR , on the internet router , and drop based on NBAR

scanning.

Dan

Re: Access-list correct?

Nagaraja Thanthry — Fri, 14 Jan 2011 18:11:00 GMT

that is correct

Re: Access-list correct?

Scott Payne — Fri, 14 Jan 2011 18:12:25 GMT

Thanks! I will give it a shot later today and will et everyone the outcome.

Re: Access-list correct?

Scott Payne — Fri, 14 Jan 2011 20:11:05 GMT

Everything works perfectly!

Thanks,

STP