ssh/telnet with acl

[knanyhy011]

hello friends I have made an acl to restrict vlans 102 , 103 to use telnet & ssh  and permit valn 100 the result I have done this but the problem is with vlan100 I can use telnet & ssh with router br1 & br2 but hq router I could not  the ping  with hq unreachable what is the problem?

BR1#sh ru

Building configuration...

Current configuration : 2429 bytes

!

version 15.4

no service timestamps log datetime msec

no service timestamps debug datetime msec

no service password-encryption

!

hostname BR1

!

!

!

enable secret 5 xxx

!

!

!

!

!

!

no ip cef

no ipv6 cef

!

!

!

username cisco secret 5xxx

!

!

!

!

!

!

!

!

ip domain-name ccna.com

!

!

spanning-tree mode pvst

!

!

!

!

!

!

interface GigabitEthernet0/0/0

no ip address

ip ospf 20 area 0

duplex auto

speed auto

!

interface GigabitEthernet0/0/0.100

encapsulation dot1Q 100 native

ip address 192.168.100.1 255.255.255.240

ip ospf 20 area 0

!

interface GigabitEthernet0/0/0.102

encapsulation dot1Q 102

ip address 192.168.100.65 255.255.255.224

ip helper-address 192.168.100.6

ip ospf 20 area 0

ip access-group 100 in

!

interface GigabitEthernet0/0/0.103

encapsulation dot1Q 103

ip address 192.168.100.33 255.255.255.240

ip helper-address 192.168.100.6

ip ospf 20 area 0

ip access-group 100 in

!

interface GigabitEthernet0/0/1

no ip address

duplex auto

speed auto

shutdown

!

interface GigabitEthernet0/0/2

no ip address

duplex auto

speed auto

shutdown

!

interface Serial0/1/0

ip address 10.10.10.2 255.255.255.252

ip ospf 20 area 0

clock rate 2000000

!

interface Serial0/1/1

ip address 10.10.10.6 255.255.255.252

ip ospf 20 area 0

ip access-group 110 out

!

interface Vlan1

no ip address

shutdown

!

interface Vlan102

mac-address 00d0.ba41.0d01

no ip address

!

router ospf 20

log-adjacency-changes

default-information originate

!

ip classless

!

ip flow-export version 9

!

!

access-list 100 deny tcp any host 10.10.10.5 eq 22

access-list 100 deny tcp any host 10.10.10.5 eq telnet

access-list 100 deny tcp any host 10.10.10.1 eq 22

access-list 100 deny tcp any host 10.10.10.1 eq telnet

access-list 100 deny tcp any host 192.168.100.1 eq 22

access-list 100 deny tcp any host 192.168.100.1 eq telnet

access-list 100 deny icmp any 192.168.100.0 0.0.0.15

access-list 100 permit ip any any

access-list 100 permit tcp any any

access-list 110 permit tcp any host 100.1.1.3 eq www

access-list 110 permit tcp any host 100.1.1.3 eq 443

access-list 110 permit tcp any host 100.1.1.2 eq smtp

access-list 110 permit tcp any host 100.1.1.2 eq pop3

access-list 110 deny tcp any any

!

!

!

!

!

line con 0

!

line aux 0

!

line vty 0

no login

transport input none

line vty 1 4

password cisco

login

transport input none

line vty 5 15

password cisco

login

!

!

!

end

[knanyhy011]

sorry friend for being late 

BR1#sh ru

Building configuration...

Current configuration : 2635 bytes

!

version 15.4

no service timestamps log datetime msec

no service timestamps debug datetime msec

no service password-encryption

!

hostname BR1

!

!

!

enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0

!

!

!

!

!

!

no ip cef

no ipv6 cef

!

!

!

username cisco secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

!

!

!

!

!

!

!

!

ip domain-name ccna.com

!

!

spanning-tree mode pvst

!

!

!

!

!

!

interface GigabitEthernet0/0/0

no ip address

ip ospf 20 area 0

duplex auto

speed auto

!

interface GigabitEthernet0/0/0.100

encapsulation dot1Q 100 native

ip address 192.168.100.1 255.255.255.240

ip ospf 20 area 0

!

interface GigabitEthernet0/0/0.102

encapsulation dot1Q 102

ip address 192.168.100.65 255.255.255.224

ip helper-address 192.168.100.6

ip ospf 20 area 0

ip access-group 100 in

!

interface GigabitEthernet0/0/0.103

encapsulation dot1Q 103

ip address 192.168.100.33 255.255.255.240

ip helper-address 192.168.100.6

ip ospf 20 area 0

ip access-group 100 in

!

interface GigabitEthernet0/0/1

no ip address

duplex auto

speed auto

shutdown

!

interface GigabitEthernet0/0/2

no ip address

duplex auto

speed auto

shutdown

!

interface Serial0/1/0

ip address 10.10.10.2 255.255.255.252

ip ospf 20 area 0

clock rate 2000000

!

interface Serial0/1/1

ip address 10.10.10.6 255.255.255.252

ip ospf 20 area 0

ip access-group 110 out

!

interface Vlan1

no ip address

shutdown

!

interface Vlan102

mac-address 00d0.ba41.0d01

no ip address

!

router ospf 20

log-adjacency-changes

default-information originate

!

ip classless

!

ip flow-export version 9

!

!

access-list 100 deny tcp any host 10.10.10.1 eq 22

access-list 100 deny tcp any host 10.10.10.1 eq telnet

access-list 100 deny tcp any host 192.168.100.1 eq 22

access-list 100 deny tcp any host 192.168.100.1 eq telnet

access-list 100 deny icmp any 192.168.100.0 0.0.0.15

access-list 100 permit ip any any

access-list 100 permit tcp any any

access-list 110 permit tcp any host 100.1.1.3 eq www

access-list 110 permit tcp any host 100.1.1.3 eq 443

access-list 110 permit tcp any host 100.1.1.2 eq smtp

access-list 110 permit tcp any host 100.1.1.2 eq pop3

access-list 110 deny tcp any any

ip access-list extended SSH-TELNET-ACCESS

permit tcp 192.168.100.0 0.0.0.15 any eq 22

permit tcp 192.168.100.0 0.0.0.15 any eq telnet

deny tcp any any eq 22

deny tcp any any eq telnet

permit ip any any

!

!

!

!

!

line con 0

!

line aux 0

!

line vty 0

access-class SSH-TELNET-ACCESS in

no login

transport input none

line vty 1 4

access-class SSH-TELNET-ACCESS in

password cisco

login

transport input none

line vty 5 15

access-class SSH-TELNET-ACCESS in

password cisco

login

!

!

!

end

BR1#

BR1#sh ip rou

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is 10.10.10.5 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks

C 10.10.10.0/30 is directly connected, Serial0/1/0

L 10.10.10.2/32 is directly connected, Serial0/1/0

C 10.10.10.4/30 is directly connected, Serial0/1/1

L 10.10.10.6/32 is directly connected, Serial0/1/1

O 10.10.10.8/30 [110/128] via 10.10.10.1, 00:03:57, Serial0/1/0

[110/128] via 10.10.10.5, 00:03:57, Serial0/1/1

192.168.100.0/24 is variably subnetted, 7 subnets, 4 masks

C 192.168.100.0/28 is directly connected, GigabitEthernet0/0/0.100

L 192.168.100.1/32 is directly connected, GigabitEthernet0/0/0.100

C 192.168.100.32/28 is directly connected, GigabitEthernet0/0/0.103

L 192.168.100.33/32 is directly connected, GigabitEthernet0/0/0.103

C 192.168.100.64/27 is directly connected, GigabitEthernet0/0/0.102

L 192.168.100.65/32 is directly connected, GigabitEthernet0/0/0.102

O 192.168.100.128/26 [110/65] via 10.10.10.1, 00:03:57, Serial0/1/0

O*E2 0.0.0.0/0 [110/1] via 10.10.10.5, 00:03:57, Serial0/1/1

[Richard Burts · Accepted solution]

Thank you for the configuration of BR1. I believe that I see the problem. Traffic to HQ goes out interface S0/1/1. That interface has an acl applied: ip access-group 110 out. What does this acl do?

access-list 110 permit tcp any host 100.1.1.3 eq www

access-list 110 permit tcp any host 100.1.1.3 eq 443

access-list 110 permit tcp any host 100.1.1.2 eq smtp

access-list 110 permit tcp any host 100.1.1.2 eq pop3

access-list 110 deny tcp any any

All of its permits and denies are specific to tcp. Remembering that in an acl there is an implicit deny any at the end we see that any icmp traffic going to HQ will be denied.That is why your ping and tracert are failing.

[knanyhy011]

Really friend thank you very very much 

[Richard Burts]

I am glad that our suggestions have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

[balaji.bandi]

 I did what you said exactly I  removed any ACL added to interface

You were told us that you removed all the ACL and failed ?

interface Serial0/1/1

ip address 10.10.10.6 255.255.255.252

ip ospf 20 area 0

ip access-group 110 out   <<- you have still this ?

[MHM Cisco World]

Friend use 

Router ospf 100

Network 0.0.0.0 0.0.0.0 area 0

In all router and l3SW 

MHM