07-22-2022
07:08 AM
- last edited on
07-23-2022
02:09 AM
by
Translator
What is the behavioral difference in the following?
permit ip 192.168.1.1 0.0.0.255 192.168.2.1 0.0.0.255
deny any any
-and-
permit ip 192.168.1.1 0.0.0.255 192.168.2.1 0.0.0.255 any
deny any any
Solved! Go to Solution.
07-22-2022 07:17 AM
any at end of ACL of IP ?
are you sure the router accept this command ??
there is no any with IP the any after source IP or destaintion IP use only for L4 port.
07-22-2022
12:58 PM
- last edited on
07-23-2022
02:18 AM
by
Translator
If you suspect that the ACL drop the packet or not
show ip access-list
you must see match
and for troublshouting,
config deny any any
in end of ACL
and
show ip access-list
see if
deny any any
have match or not
07-22-2022 07:17 AM
any at end of ACL of IP ?
are you sure the router accept this command ??
there is no any with IP the any after source IP or destaintion IP use only for L4 port.
07-22-2022
09:04 AM
- last edited on
07-23-2022
02:12 AM
by
Translator
Let me rephrase.
if there is:
permit ip 192.168.1.1 0.0.0.255 192.168.2.1 0.0.0.255 deny any any
By using the IP Suite, this should allow all TCP, UDP, ICMP protocols.
I read in another forum that if written like this and a
deny any any
is at the end, those protocols are dropped if not specifically called on. Is this true?
I have a server connected to one vlan that receives all the information from that vlan and there are three acls connecting the other two vlans to the one however, netstat does not show that it is passing the specific port traffic and the server is not collecting the information as it should.
07-22-2022
10:38 AM
- last edited on
07-23-2022
02:15 AM
by
Translator
"If there is:
permit ip 192.168.1.1 0.0.0.255 192.168.2.1 0.0.0.255 deny any any
By using the IP Suite, this should allow all TCP, UDP, ICMP protocols."
Only for the source and destination IPs are within the corresponding /24 source and destination networks.
As your source and destination networks are different, you would also need to insure the ACL is applied, correctly, to match source and destination. I.e. your ACL, if applied to both directions of traffic, would block one direction and permit the other.
A both directions ACL might be written as:
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
deny any any
BTW, as you're matching /24 networks, usually the network IP would be .0, not .1, although either will function the same.
Also every ACL ends with an explict
deny any any
Often you only include the ACE, explicitly, it if your looking to obtain a count for packets falling through to end of ACL and/or you wish to "log" such packets.
07-22-2022 12:46 PM
07-22-2022
12:58 PM
- last edited on
07-23-2022
02:18 AM
by
Translator
If you suspect that the ACL drop the packet or not
show ip access-list
you must see match
and for troublshouting,
config deny any any
in end of ACL
and
show ip access-list
see if
deny any any
have match or not
07-22-2022 02:45 PM
Thank you. I completely forgot about that.
I got what I was looking for with that.
07-22-2022
01:13 PM
- last edited on
07-23-2022
02:19 AM
by
Translator
Deny any any
does block all that hits such a rule, but again, the ACL you posted includes networks that need to match too.
If you want to allow all IP and block all else, that might be done with:
permit ip any any deny any any
07-22-2022 02:47 PM
Yes it was a bad example.
07-22-2022 02:49 PM
this entire session was enlightening even if I gave a bad example.
You both were very helpful and knowledgeable.
Hope to be there someday.
07-22-2022 09:12 AM
https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html
This doc. From Cisco for many acl example
Using tcp udp icmp
Take look
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide