Access list for ACS 3.3

[fvramirez]

i wish to secure my ACS using access-list. however, allowing just tcp port 49 and/or tcp/udp port 65 doesnt seem to work. is there any other ports i need to open?

[paddyxdoyle]

When you say "it doesn't seem to work", what are you refering to, TACACS authentication or access to the ACS server for admin purposes?

Can you add a "deny ip any any log" rule to the bottom of your access-list and check which protocols are being dropped?

Thanks

PD

[fvramirez]

got it! thanks..

it seems the acs uses port 49 but the router uses a random high port number.