ACL to deny telnet from any host on subnet

[Deanmikawa]

Hello, I need to configure an ACL to deny telnet from any host on subnet 135.79.40.0/24 to anything on other subnets.  

I think I want to do something like this:

access-list 150 deny tcp host 135.79.40.0 0.0.0.255 any eq telnet

But I am not getting any results.... How can I configure my ACL to deny telnet requests from hosts on that subnet?

Attatched is a map of the network I am currently working with.  The goal is to deny telnet attempts from host E into router b and c, switch a and b.

Thank you,
Dean

[Julio E. Moisa]

Hi

Have you tried to configure the following parameters on Router A' s0/0 interface?

**Also remove the host word, it is used when you are specifying a /32 IP address. There are 2 ways to configure a host, example:

access-list 150 deny tcp host 135.79.40.10 any eq telnet

or 

access-list 150 deny tcp 135.79.40.10 0.0.0.0 any eq telnet 

Now try this configuration on Router A's serial 0/0 interface 

access-list 150 deny tcp 135.79.40.0 0.0.0.255 any eq telnet   

access-list 150 permit ip any any

interface s0/0

ip access-group 150 out

[Deanmikawa]

access-list 150 deny tcp 135.79.40.0 0.0.0.255 any eq telnet
gives me incomplete command

access-list 150 deny tcp 135.79.40.0 0.0.0.255 any eq telnet ?
gives me unrecognized command

I have also tried
RouterC(config)#access-list 150 deny tcp host 135.79.40.0 0.0.0.255 135.79.10.2 eq telnet
RouterC(config)#access-list 150 permit ip any any
RouterC(config)#int s0/1
RouterC(config-if)#ip access-group 150 in

and it blocks telnet into router b but allows telnet into everything else

[Julio E. Moisa]

Hi

Try with on RA's Serial 0/0

access-list 150 deny tcp 135.79.40.0 0.0.0.255 any eq 23  

access-list 150 permit ip any any

int s0/0

ip access-group 150 out

[Deanmikawa]

After configuring
access-list 150 deny tcp 135.79.40.0 0.0.0.255 any eq 23

access-list 150 permit ip any any



int s0/0

ip access-group 150 out

I am still able to telnet into the routers from Host e

[Julio E. Moisa]

Hi

Have you verified if the configuration is not after of a permit any any on router A? Try to remove the ACL 150 and please try again. 

Also you can check the matches using show access-list 150. 

[Deanmikawa]

ok i have tried again with a fresh router with no configs. 

same result, I am able to telnet into the routers.

posted is a result of show access-list 150 command, doesn't not yield response though.

[Julio E. Moisa]

Hi,

You should execute the command on privilege user prompt. (#)

[Deanmikawa]

Ok results:
RouterC#showaccess-list 150
Extended IP access list 150

       deny tcp 135.79.40.0 0.0.0.255 any eq telnet
       permit ip any any

This is after a fresh attempt and am still able to telnet

[Julio E. Moisa]

Try this lines just to verify because I dont see hits

no access-list 150

access-list 150 deny tcp any any eq 23

access-list 150 permit ip any any

int serial 0/0

ip access-group 150 out 

[Deanmikawa]

Here are results up to first incomplete command: access-list 150 deny tcp any any eq 23

[Julio E. Moisa]

Hi

I have not received any error message, are you using bossom?