Access-list correct?

[Scott Payne]

Hello everyone!

I am working on locking down the access to the internet and wanted to do a quick test. Below is my config with the new line of code in bold. I am trying to block specific ports while allowing everything else.

My question is: "Will this work?"

access-list 101 extended permit tcp host 10.1.5.80 any eq smtp
access-list 101 extended permit tcp host 10.1.5.91 any eq smtp
access-list 101 extended permit tcp host 10.1.5.50 any eq smtp
access-list 101 extended deny tcp any any eq smtp
access-list 101 extended deny tcp any any range 1495 - 2597
access-list 101 extended permit ip any any

Thanks,

Scott

[Nagaraja Thanthry]

Hello,

So, the three devices (.80/91/50) are your mail servers that will be talking to external mail servers. Is that correct? Also, what device you are implementing this access-list on? If it is on a dedicated firewall (PIX/ASA), this should work fine. If you are doing it on a router, then you might need to make sure that none of the servers are being contacted by the external clients using source port in the range of 1495 - 2597.

Hope this helps.

Regards,

NT

[Scott Payne]

This is on an ASA 5520. And I am only trying to block a range of ports for testing. Once everything starts to look correct, I was planning to remove the ip any any statement and just add permit statements for the specific ports. I did this range so i could try and break internet messenger as a test. We have no devices utilizing these ports.

If I am understanding correctly, I see that it should successfully block IM traffic and allow everything else.

[Dan-Ciprian Cicioiu]

You might try using NBAR , on the internet router , and drop based on NBAR

scanning.

Dan

[Nagaraja Thanthry]

that is correct

[Dan-Ciprian Cicioiu · Accepted solution]

If you want to block all the TCP flows with the dst port 1495 - 2597 :

- remove the "-" between the range

access-list 101 deny tcp any any range 1495 2597

Dan

[Scott Payne]

Thanks! I will give it a shot later today and will et everyone the outcome.

[Scott Payne]

Everything works perfectly!

Thanks,

STP