cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
319
Views
10
Helpful
4
Replies

Access-list

I have configured access-list on my router where only DHCP, DNS, and web traffic is allowed no other traffic.
As I apply the Access-list to the sub-interface it rejects DNS but I can reach the web traffic through the Server IP address.
What can be the problem that it can't resolve domain names?

Commands on the router...

Extended IP access list 101

10 permit tcp 192.168.2.0 0.0.0.255 192.168.10.0 0.0.0.255 eq www 

20 permit tcp 192.168.2.0 0.0.0.255 192.168.10.0 0.0.0.255 eq bootps

30 permit tcp 192.168.2.0 0.0.0.255 192.168.10.0 0.0.0.255 eq domain

40 deny ip any any

Interface g0/0.20

ip access-group 101 in

 

1 ACCEPTED SOLUTION

Accepted Solutions
Martin L
VIP Advocate

 

DNS also uses UDP protocol in additon to TCP. so, please try with another line of 

permit udp any eq 53 any eq 53 

 

Regards, ML
**Please Rate All Helpful Responses **

View solution in original post

4 REPLIES 4
Martin L
VIP Advocate

 

DNS also uses UDP protocol in additon to TCP. so, please try with another line of 

permit udp any eq 53 any eq 53 

 

Regards, ML
**Please Rate All Helpful Responses **

View solution in original post

luis_cordova
VIP Advisor

Hi @shahalizada038889 

 

Compress your exercise (winzip) and attach it to check.

 

Regards

Hi!
Thanks for the support, I appreciate it.

it solved the Domain resolution issue now I'm able to resolve domain names. But DHCP is still being blocked????

 

I think DHCP also needs 2 entries; bootps and bootpc

Please use ? anytime you forget numbers or option

 

Router(config-ext-nacl)#permit udp any eq ?

<0-65535> Port number

bootpc Bootstrap Protocol (BOOTP) client (68)

bootps Bootstrap Protocol (BOOTP) server (67)

 

 

Regards, ML
**Please Rate All Helpful Responses **

Content for Community-Ad