cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
164
Views
15
Helpful
4
Replies
m.x Beginner
Beginner

Extended ACL Question

Hi,

 

As a recent CCNA R&S graduate I'm still a bit confused when it gets to extended ACL's combined with static NAT.

So I got this question; If you create an extended ACL and you use this command:

permit ip 10.0.0.1 0.0.0.0 any 
All protocols are permitted with their associated ports, right?

 

And if you then use a static NAT command such as:

ip nat source static tcp 10.0.01 3389 interface Dialer0 3389

 

There shouldn't be a problem.. connecting to 10.0.0.1 through the IP of Dialer0.. Or do I have to include the protocol and port-number in the ACL? 

 

Greeting 

Marnix

4 REPLIES 4
Highlighted
Cisco Employee

Re: Extended ACL Question

Hi m.x,

 

They both are different ways of enabling NAT for specific flow/host. The use of ACL is to identify a range of source/destination while static is specific.

 

In your example, creating "ip nat source static tcp 10.0.01 3389 interface Dialer0 3389" will work and does not need 3389 port to be allowed on ACL. They are not related.

 

HTH,

Nagendra

Enthusiast

Re: Extended ACL Question

hi,

yes. you can use this format. but in ACL, if you use 0.0.0.0 as a subnet mask that it equal to word 'any'. so use correct subject. from
also use nat command like below format
ip nat outside source static tcp <inside ip> <inside port> <outside ip> <outside port> extendable
VIP Advisor

Re: Extended ACL Question

your NAT statement is a subset of your ACL. i,e, the acl allow all IP traffic from 10.0.0.1 to any destination irrespective of ports. so your NAT statement is more specific than that as it specifies a tcp port.

 

interms order, I am not sure what is processed first: the acl or the NAT statement. (ASA first apply nat ingress after that the acl ingress). not sure bout ios devices to be honest

Please remember to rate useful posts, by clicking on the stars below.

m.x Beginner
Beginner

Re: Extended ACL Question

Thank you all for replying! Very helpful!
CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards