SORRY DEAR i have a project of 3 routers hq, br1 and br2 in br1 3 vlans
vlan100=192.168.100.0/28 IN ROUTER BR1
vlan102=192.168.100.64/27 IN ROUTER BR1
vlan103=192.168.100.32/28 IN ROUTER BR1
with acl & ssh/tenet I just permit vlan100=192.168.100.0/28 & deny others, from vlan100 I can log in br1 & br2 but not hq
THE IP FOR HQ ROUTER IS 10.10.10.5 THAT I CAN NOT REACH
THE IP FOR BR1 192.168.100.1 I CAN REACH
THE IP FOR BR2 10.10.10.1 I CAN REACH
You have ACL here - which deny for IN access-list 100 deny icmp any 192.168.100.0 0.0.0.15
yes here i denyed icmp on vlan102,103 in router br1 but not others br2,hq
from what source are you using to reach HQ= VLAN100 IP 192.168.100.5 & 192.168.100.6
where is HQ device configuration here ?
HQ#sh running-config
Building configuration...
Current configuration : 2214 bytes
!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname HQ
!
!
!
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
username cisco secret 5 $1$mERr$3HhIgMGBA/9qNmgzccuxv0
username class secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1
!
!
!
!
!
!
!
!
ip domain-name ccna3.com
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0/0
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/0/1
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/1/0
ip address 209.1.1.2 255.255.255.252
ip access-group 100 in
ip access-group 100 out
ip nat outside
clock rate 2000000
!
interface Serial0/1/1
ip address 10.10.10.5 255.255.255.252
ip nat inside
clock rate 2000000
!
interface Serial0/2/0
ip address 10.10.10.9 255.255.255.252
ip nat inside
clock rate 2000000
!
interface Serial0/2/1
no ip address
clock rate 2000000
shutdown
!
interface Vlan1
no ip address
shutdown
!
router ospf 10
log-adjacency-changes
network 10.10.10.4 0.0.0.3 area 0
network 10.10.10.8 0.0.0.3 area 0
network 209.1.1.0 0.0.0.3 area 0
default-information originate
!
ip nat pool nat-pool 60.60.60.3 60.60.60.8 netmask 255.255.255.240
ip nat inside source list 1 pool nat-pool overload
ip nat inside source static 192.168.100.6 60.60.60.1
ip nat inside source static 192.168.100.5 60.60.60.2
ip classless
ip route 0.0.0.0 0.0.0.0 209.1.1.1
!
ip flow-export version 9
!
!
access-list 100 permit tcp any 192.168.100.0 0.0.0.15 established
access-list 100 permit tcp any 192.168.100.64 0.0.0.31 established
access-list 100 permit tcp any 192.168.100.32 0.0.0.15 established
access-list 100 permit tcp any 192.168.100.128 0.0.0.63 established
access-list 100 permit tcp any any
access-list 1 permit 192.168.100.0 0.0.0.15
access-list 1 permit 192.168.100.64 0.0.0.31
access-list 1 permit 192.168.100.32 0.0.0.15
access-list 1 permit 192.168.100.128 0.0.0.63
access-list 1 deny any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login local
line vty 5 15
no login
!
!
!
end
where is BR1 device configuration here ? I did the configure acl in br1 because the vlans in it
BR1#sh running-config
Building configuration...
Current configuration : 2650 bytes
!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname BR1
!
!
!
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
username cisco secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1
!
!
!
!
!
!
!
!
ip domain-name ccna.com
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0/0.100
encapsulation dot1Q 100 native
ip address 192.168.100.1 255.255.255.240
!
interface GigabitEthernet0/0/0.102
encapsulation dot1Q 102
ip address 192.168.100.65 255.255.255.224
ip helper-address 192.168.100.6
!
interface GigabitEthernet0/0/0.103
encapsulation dot1Q 103
ip address 192.168.100.33 255.255.255.240
ip helper-address 192.168.100.6
!
interface GigabitEthernet0/0/1
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/1/0
ip address 10.10.10.2 255.255.255.252
clock rate 2000000
!
interface Serial0/1/1
ip address 10.10.10.6 255.255.255.252
ip access-group 110 out
!
interface Vlan1
no ip address
shutdown
!
interface Vlan102
mac-address 00d0.ba41.0d01
no ip address
!
router ospf 10
log-adjacency-changes
network 192.168.100.0 0.0.0.15 area 0
network 192.168.100.64 0.0.0.31 area 0
network 192.168.100.32 0.0.0.15 area 0
network 10.10.10.4 0.0.0.3 area 0
network 10.10.10.0 0.0.0.3 area 0
default-information originate
!
ip classless
!
ip flow-export version 9
!
!
access-list 100 deny tcp any host 10.10.10.5 eq 22
access-list 100 deny tcp any host 10.10.10.5 eq telnet
access-list 100 deny tcp any host 10.10.10.1 eq 22
access-list 100 deny tcp any host 10.10.10.1 eq telnet
access-list 100 deny tcp any host 192.168.100.1 eq 22
access-list 100 deny tcp any host 192.168.100.1 eq telnet
access-list 100 deny icmp any 192.168.100.0 0.0.0.15
access-list 100 permit ip any any
access-list 100 permit tcp any any
access-list 110 permit tcp any host 100.1.1.3 eq www
access-list 110 permit tcp any host 100.1.1.3 eq 443
access-list 110 permit tcp any host 100.1.1.2 eq smtp
access-list 110 permit tcp any host 100.1.1.2 eq pop3
access-list 110 deny tcp any any
ip access-list extended ssh/tel
permit tcp 192.168.100.0 0.0.0.15 any eq 22
permit tcp 192.168.100.0 0.0.0.15 any eq telnet
deny tcp any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0
access-class ssh/tel in
no login
transport input none
line vty 1 4
access-class ssh/tel in
password cisco
login
transport input none
line vty 5 15
password cisco
login
!
!
!
end
BR1#
- BR2 HAS ANOTHER RANGE & CONFIGRATION HERE YOU ARE:
BR2#sh running-config
Building configuration...
Current configuration : 2233 bytes
!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname BR2
!
!
!
!
ip dhcp excluded-address 192.168.100.129 192.168.100.135
!
ip dhcp pool LAN-POOL
network 192.168.100.128 255.255.255.192
default-router 192.168.100.129
!
!
!
no ip cef
no ipv6 cef
!
!
!
username cisco secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1
!
!
!
!
!
!
!
!
ip domain-name ccna.com
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0/0
ip address 192.168.100.129 255.255.255.192
ip access-group 101 in
duplex auto
speed auto
!
interface GigabitEthernet0/0/1
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/1/0
ip address 10.10.10.10 255.255.255.252
!
interface Serial0/1/1
ip address 10.10.10.1 255.255.255.252
!
interface Vlan1
no ip address
shutdown
!
router ospf 10
log-adjacency-changes
network 10.10.10.0 0.0.0.3 area 0
network 10.10.10.8 0.0.0.3 area 0
network 192.168.100.128 0.0.0.63 area 0
default-information originate
!
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit tcp 192.168.100.128 0.0.0.63 host 192.168.100.5 eq ftp
access-list 101 permit ip 192.168.100.128 0.0.0.63 192.168.100.64 0.0.0.31
access-list 101 deny tcp 192.168.100.128 0.0.0.63 host 10.10.10.9 eq 22
access-list 101 deny tcp 192.168.100.128 0.0.0.63 host 10.10.10.9 eq telnet
access-list 101 deny tcp 192.168.100.128 0.0.0.63 host 10.10.10.2 eq 22
access-list 101 deny tcp 192.168.100.128 0.0.0.63 host 10.10.10.2 eq telnet
access-list 101 deny tcp 192.168.100.128 0.0.0.63 host 192.168.100.129 eq 22
access-list 101 deny tcp 192.168.100.128 0.0.0.63 host 192.168.100.129 eq telnet
access-list 101 permit tcp any host 100.1.1.3 eq www
access-list 101 permit tcp any host 100.1.1.3 eq 443
access-list 101 permit tcp any host 100.1.1.2 eq smtp
access-list 101 permit tcp any host 100.1.1.2 eq pop3
access-list 101 deny tcp any any
access-list 101 deny ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0
no login
transport input none
line vty 1 4
password cisco
login
transport input none
line vty 5 15
password cisco
login
!
!
!
end
BR2#
