cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
198
Views
0
Helpful
6
Replies
Highlighted
Beginner

ACL Exception for Subnet

I have a Cisco ISR with a massive ACL. Right now have device A (at 204.77.x.n) unreachable outside of its own subnet (say 204.77.x.n/16), but I would like to reach device A from an outside subnet (say 10.10.10.1/24). How could I accomplish this?

 

Here are my current relevant ACL entries:

access-list 2011 deny ip any host 204.77.x.n
access-list 2011 deny ip host 204.77.x.n any
access-list 2021 deny tcp any host 204.77.x.n eq telnet
access-list 2021 deny tcp host 204.77.x.n any eq telnet

6 REPLIES 6
Highlighted
VIP Expert

not sure how your network in terms of syntax

 

example as below should be top of denying to permit. (make sure correct the line numbers)

access-list 2011 permit ip host 204.77.x.n 10.10.10.1/24



BB


*** Rate All Helpful Responses ***

Highlighted
Hall of Fame Guru

 

Why do you have two different acls and what direction are they applied in ? 

 

Also you are denying IP in the first acl so what is the second acl actually doing ? 

 

Jon

Highlighted
VIP Expert

Hello,

 

it would indeed be helpful to see the entire ACL, and to know which interface (and direction) the ACL is applied to.

 

Either way, if the ACL is applied to the interface belonging to the 204.77.0.0/16 subnet, the below two entries need to be added to the top of the ACL:

 

interface GigabitEthernet0/0
ip address 204.77.0.1 255.255.0.0
ip access-group 2011 in
!
access-list 2011 permit ip host 204.77.0.1 10.10.10.0 0.0.0.255
access-list 2011 permit ip 10.10.10.0 0.0.0.255 host 204.77.0.1

Highlighted

 

Georg

 

That's why I wanted to see the acl(s) as the second line in your solution is redundant ie. if the acl is applied inbound traffic can never have a source IP in the 10.10.10.x range. 

 

I suspect this could be why the acl is so large. 

 

Jon

Highlighted

Jon,

 

good point. Based on the partial ACL posted, it is probably applied inbound AND outbound. I guess we need to wait for a response from OP...

Highlighted
VIP Mentor

Hello
You will need in the acls  the most specific ace above the others ace’s to allow communication.

as others have mentioned we need to understand how these acls are applied as the order of the aces in the acl are most relevant Also what ports do you wish for those two host to communicate -In the example below ive allowed tcp/udp and notice the aces in bold are above the others aces the acl.

example:
access-list 2021 permit ip host 10.10.10.1 host 204.77x.n

access-list 2021 deny tcp any host 204.77.x.n eq telnet

access-list 2011 deny ip any host 204.77.x.n

 

access-list 2021 permit ip host 204.77.x.n host 10.10.10.1

access-list 2021 deny tcp host 204.77.x.n any eq telnet

access-list 2011 deny ip host 204.77.x.n any

Edited: forgot to ask are you using NAT



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future