In extended access-list does ip mean include both tcp and udp and other protocols ?

[Georg Pauwen]

Hello,

exactly. IP includes all UDP and TCP protocols...

[dolanduck.]

so lets say for example i do deny ip host 192.168.1.3 any 

does that mean it will block icmp, tcp , udp and others ?

or only tcp and udp ?

[Georg Pauwen]

Hello,

that's right, 'deny ip host 192.168.1.3 any' will block all protocols including ICMP. 

[dolanduck.]

wow dude thanks for answering that really cleared things up.

[Georg Pauwen]

Hello,

keep in mind that access lists are processed top down, so the order matters. If you want to e.g. allow ICMP, but deny anyting else, the access list would be:

permit icmp host 192.168.1.3 any

deny ip host 192.168.1.3 any

[dolanduck.]

alright so is this what you mean ?. so for example want to block ssh access to everyone else except on person.

would this work.

permit tcp host 192.168.1.2 any eq 22

deny tcp any any eq 22

permit ip any any-> I added this because i think there is a deny ip any any at the end by default ?

[Georg Pauwen]

Hello,

exactly. Looks like you got the hang of it.

permit tcp host 192.168.1.2 any eq 22

deny tcp any any eq 22

permit ip any any

This allows SSH for just that one host, 192.168.1.2, and denies SSH for all others. It allows everything else for all.

[dolanduck.]

does the implicit deny at the end block all traffic ?

[Georg Pauwen · Accepted solution]

Hello,

if you don't add the last line:

permit ip any any

then indeed, the implicit deny all will block all other traffic that is not explicitly permitted.