cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
300
Views
0
Helpful
3
Replies

Pix 515E ACLs

ewong0088
Level 1
Level 1

What is the best way and recommended way to create an ACL to deny incoming traffic from certain internet hosts? (Spammers, Malwares, etc)

Create a network-group and add their IPs to that group one at a time. Deny this group from the outside interface?

Any pointer is appreciated. By the way, how do you guys create/modify acl entries when there are entries in the acl already and you want to put the new line at the top or in the middle or something. Is using a telnet client with cut and paste functionality the only way?

Thanks, Eric

3 Replies 3

jmia
Level 7
Level 7

Eric,

I would go with Object-grouping method, on you question for ACL editing, I write my ACLs on notepad editor and then cut/paste back onto the firewall. This way any mistakes can be rectified before going live!

Hope this helps.

Jay

morbfrhtc
Level 1
Level 1

AFAIK, there isn't any direct possibility how to edit entries/lines in ACLs. There are not line numbers or something similar. So if you made a mistake you have to start it all over.

I tried to write ACL in editor(like notepad) and then passed it to firewall. I found that this is not possible(I didn't work for me; maybe I am not clever though ;o)

stevep
Level 1
Level 1

morbfrhtc

Sorry to have to correct you but you can edit ACL's in the manner that ewong0088 has specified.

ewong0088

Look at the example below which will hopefully clarify matters.

sh access-list inside_access_in

access-list inside_access_in line 1 permit tcp any host ukjpm001 eq tacacs (hitcnt=87378)

access-list inside_access_in line 2 permit udp any host ukjpm001 eq radius (hitcnt=1879)

access-list inside_access_in line 3 permit udp any host ukabc001 eq radius (hitcnt=1259)

access-list inside_access_in line 4 permit udp any host ukdef001 eq radius (hitcnt=18)

access-list inside_access_in line 5 permit udp any host ukdmz001 eq radius (hitcnt=122977)

no access-list inside_access_in line 3 permit udp any host ukabc001 eq radius (hitcnt=1259)

sh access-list inside_access_in

access-list inside_access_in line 1 permit tcp any host ukjpm001 eq tacacs (hitcnt=87378)

access-list inside_access_in line 2 permit udp any host ukjpm001 eq radius (hitcnt=1879)

access-list inside_access_in line 3 permit udp any host ukdef001 eq radius (hitcnt=18)

access-list inside_access_in line 4 permit udp any host ukdmz001 eq radius (hitcnt=122977)

Should you wish, you can also apply remarks at any point in the ACL, although I would recommend placing them at the top to clearly identify the ACL's role.

Steve.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card