Re: Access Control List

aseijas · ‎09-13-2004

Hi everyboy, i have a doubt and try to solve it here.

we have a cisco switch 5500 with a some vlan per department. the customer ask us implement some kind of control between users at remote sites/branch and headquarters. we implemented an standard access-list with the ip permit suply by customer. the problem started when they ask us to block access to WWW services too. we implemented an extended access-list with tcp protocol and www services permit but when apply the ACL´s we don´t get the expected response. Next i show you an extract of the commands applies:

STANDARD (working)

access-list 10 permit 172.16.x.x

EXTENDED (fail)

access-list 110 permit tcp any any eq www

access-list 110 permit ip host 172.16.x.x any

of course ip´s out of the list would be denied.

Thank a lot for your comments

AS

aseijas · ‎09-13-2004

Sorry the idea is permit some users to get WWW services.

AS

glen.grant · ‎09-13-2004

In your message you say they asked to block some WWW services , the way it is written you are permiting everyone access to WWW . You would have to write specific deny statements for which addresses are to be blocked from WWW and then permit everyone else access to WWW .

aseijas · ‎09-13-2004

Sorry the idea is permit some users to get WWW services. I just to permit WWW services and then the customers will complete the permissions through the firewall. I have to permit that from remotes site employees can access WWW of course i don´t know which sites and which source for that reason i´ve implemented an extended access list that permit tcp any any eq wwww and permit other specific ip host.

Thank,

AS.

Kevin Dorrell · ‎09-13-2004

You say you don't get the expected response. What actually happens? What are the symptoms of the problem?

I presume these access lists are applied to filter outgoing packets towards your firewall, which is then connected onwards towards the Internet. Can you confirm that?

Be aware that the www line concerns only HTTP accesses, i.e. to port tcp/80. It does not allow any other service ports.

I'm not sure I fully understand your architecture. Why are you not doing all of this with the firewall rather than using an ACL?

Kevin Dorrell

Luxembourg