Named ACL's vs Numbered ACL's

[Didier1966]

Hello,

In my test lab I am playing with the Numbered ACL's and Named ACL's.

Both configurations are working BUT , I am sure I do something wrong in the Named ACL's version.

When I reboot or reload the CISCO 1841 ROUTER , I do not have INTERNET anymore , I still have access by TELNET or SSH , but no external communication anymore.

The only way to start the communication again , is by adding :

PERMIT IP ANY ANY

This will ofcourse work , but the funny thing is that when I do a :

NO PERMIT IP ANY ANY

It still works !!!

I have learned by this to always shut down and restart my ROUTER or SWITCH to see if everything still work

Here bellow some parts of the working Numbered ACL's version :

ip ssh time-out 60

ip ssh authentication-retries 2

ip ssh port 8096 rotary 1

ip ssh version 2

!        

!        

!        

interface FastEthernet0/0

description DMZ

ip ddns update hostname mlgw.dyndns.info

ip ddns update DynDNS

ip address dhcp

no ip unreachables

no ip proxy-arp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

ip nat inside source static tcp 192.168.10.10 80 interface FastEthernet0/0 8095

!        

access-list 101 permit ip 192.168.10.0 0.0.0.255 any

Here bellow some parts of the NOT SAFE working Named ACL's version : (FULL VERSION IS ATTACHED)

interface FastEthernet0/0

description DMZ

ip ddns update hostname mlgw.dyndns.info

ip ddns update DynDNS

ip address dhcp

ip access-group dri-acl-in in

ip access-group dri-acl-out out

no ip unreachables

no ip proxy-arp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

ip nat inside source static tcp 192.168.10.10 80 interface FastEthernet0/0 8095

ip nat inside source list dri-acl-in interface FastEthernet0/0 overload

ip nat inside source list dri-acl-out interface FastEthernet0/0 overload

!

ip access-list extended dri-acl-in

permit ip any any

ip access-list extended dri-acl-out

permit ip any any

!

When I add this to open only the ports I need , this does not work after a RESET or RELOAD :

permit udp any any eq domain

permit udp any eq domain any

permit tcp any any eq domain

permit tcp any eq domain any

permit tcp any any eq www

permit tcp any eq www any

permit tcp any any eq pop3

permit tcp any eq pop3 any

permit tcp any any eq smtp

permit tcp any eq smtp any

permit tcp any any eq 443

permit tcp any eq 443 any

permit tcp any any eq 8096

permit tcp any eq 8096 any

NOTE : WITH THE Numbered ACL's VERSION I WAS ABLE TO HAVE ACCESS TO MY ROUTER FROM THE WAN ON PORT 8096 (IP=xxx.xxx.xxx.xxx:8096)

WITH THE NAMED VERSION EVEN WITH IP ANY ANY , IT DOES NOT WORK !!!

Thanks in advace for your help and Happy New Year

Didier

[Peter Paluch · Accepted solution]

Didier,

Let's try to clean up the configuration a little before proceeding with your current issue. Now, you are sharing the ACL between your interface and the NAT configuration. That is not a best practice because both ACLs principially serve two different and distinct purposes so it is better to keep them separated. Another issue is that the Cisco NAT implementation does not support the "permit ip any any" type of ACLs and that may account for some of your troubles.

So I suggest you keep your dri-acl-in and dri-acl-out ACLs and use them only on your Fa0/0 interface. However, for the NAT, I strongly recommend creating a separate ACL, for example (you can directly paste the following commands into your configuration mode):

ip access-list standard NAT
 permit 192.168.0.0 0.0.255.255
!
no ip nat inside source list dri-acl-in interface FastEthernet0/0 overload
no ip nat inside source list dri-acl-out interface FastEthernet0/0 overload
ip nat inside source list NAT interface FastEthernet0/0 overload

Try implementing these changes first and only then please try to modify your dri-acl-in and dri-acl-out as you wish them to be.

Best regards,

Peter

[Didier1966]

Hello Peter,

Thank you for your prompt reply , it works

I have even learn that I can remove some lines in the IN and OUT ACL , I will remove the one that have no matches.

ROUTER1841#sh access-lists

Standard IP access list NAT

    10 permit 192.168.0.0, wildcard bits 0.0.255.255 (146 matches)

Extended IP access list dri-acl-in

    10 permit udp any any eq domain

    20 permit udp any eq domain any (72 matches)

    30 permit tcp any any eq domain

    40 permit tcp any eq domain any

    50 permit tcp any any eq www

    60 permit tcp any eq www any (55 matches)

    70 permit tcp any any eq 443

    80 permit tcp any eq 443 any (403 matches)

    90 permit tcp any any eq pop3

    100 permit tcp any eq pop3 any (50 matches)

    110 permit tcp any any eq smtp

    120 permit tcp any eq smtp any (8 matches)

Extended IP access list dri-acl-out

    10 permit udp any any eq domain (24 matches)

    20 permit udp any eq domain any

    30 permit tcp any any eq domain

    40 permit tcp any eq domain any

    50 permit tcp any any eq www (82 matches)

    60 permit tcp any eq www any

    70 permit tcp any any eq 443 (318 matches)

    80 permit tcp any eq 443 any

    90 permit tcp any any eq pop3 (76 matches)

    100 permit tcp any eq pop3 any

    110 permit tcp any any eq smtp (13 matches)

    120 permit tcp any eq smtp any

ROUTER1841#

Best Regards and HAPPY NEW YEAR

Didier

[Peter Paluch · Accepted solution]

Hello Didier,

I am glad it started working Thank you and let me also wish you all the very best!

Best regards,

Peter

[Didier1966]

.

Message was edited by: Didier Ribbens