simple question

jonl711 — Fri, 21 Feb 2020 12:57:09 GMT

What is the difference in the following:

access-list 100 permit tcp any any a.b.c.d 0.0.0.255 w.x.y.z 0.0.0.255 eg 22

access-list 100 permit tcp a.b.c.d 0.0.0.255 w.x.y.z 0.0.0.255

My question is:

does the 1st one allows only ssh traffic?

does the 2nd one allow all traffic?

can the 1st one be written as

access-list 100 permit tcp a.b.c.d 0.0.0.255 w.x.y.z 0.0.0.255 eg 22

Re: simple question

Karsten Iwen — Tue, 13 Aug 2013 06:43:30 GMT

You fist line has a wrong syntax. It *has* to be written

access-list 100 permit tcp a.b.c.d 0.0.0.255 w.x.y.z 0.0.0.255 eg 22

Just think about what an ACE expects at which place. And with the given mask, "d" and "z" have to be "0".

After that correction, your assumptions are nearly right. The first line allows SSH betweeen the two given subnets (or whatever runs on TCP/22 on the destination machine) while the second allows all TCP-Traffic, but nothing else (ICMP/UDP/GRE ...).

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

topic Re: simple question in Network Security

simple question

Re: simple question