ACL Exception for Subnet

[claya]

I have a Cisco ISR with a massive ACL. Right now have device A (at 204.77.x.n) unreachable outside of its own subnet (say 204.77.x.n/16), but I would like to reach device A from an outside subnet (say 10.10.10.1/24). How could I accomplish this?

Here are my current relevant ACL entries:

access-list 2011 deny ip any host 204.77.x.n
access-list 2011 deny ip host 204.77.x.n any
access-list 2021 deny tcp any host 204.77.x.n eq telnet
access-list 2021 deny tcp host 204.77.x.n any eq telnet

[balaji.bandi]

not sure how your network in terms of syntax

example as below should be top of denying to permit. (make sure correct the line numbers)

access-list 2011 permit ip host 204.77.x.n 10.10.10.1/24

[Jon Marshall]

Why do you have two different acls and what direction are they applied in ? 

Also you are denying IP in the first acl so what is the second acl actually doing ? 

Jon

[Georg Pauwen]

Hello,

it would indeed be helpful to see the entire ACL, and to know which interface (and direction) the ACL is applied to.

Either way, if the ACL is applied to the interface belonging to the 204.77.0.0/16 subnet, the below two entries need to be added to the top of the ACL:

interface GigabitEthernet0/0
ip address 204.77.0.1 255.255.0.0
ip access-group 2011 in
!
access-list 2011 permit ip host 204.77.0.1 10.10.10.0 0.0.0.255
access-list 2011 permit ip 10.10.10.0 0.0.0.255 host 204.77.0.1

[Jon Marshall]

Georg

That's why I wanted to see the acl(s) as the second line in your solution is redundant ie. if the acl is applied inbound traffic can never have a source IP in the 10.10.10.x range. 

I suspect this could be why the acl is so large. 

Jon

[Georg Pauwen]

Jon,

good point. Based on the partial ACL posted, it is probably applied inbound AND outbound. I guess we need to wait for a response from OP...

[paul driver]

Hello
You will need in the acls  the most specific ace above the others ace’s to allow communication.

as others have mentioned we need to understand how these acls are applied as the order of the aces in the acl are most relevant Also what ports do you wish for those two host to communicate -In the example below ive allowed tcp/udp and notice the aces in bold are above the others aces the acl.

example:
access-list 2021 permit ip host 10.10.10.1 host 204.77x.n

access-list 2021 deny tcp any host 204.77.x.n eq telnet

access-list 2011 deny ip any host 204.77.x.n

access-list 2021 permit ip host 204.77.x.n host 10.10.10.1

access-list 2021 deny tcp host 204.77.x.n any eq telnet

access-list 2011 deny ip host 204.77.x.n any

Edited: forgot to ask are you using NAT