Why use "gt 1023"

[manuel.dennis]

Looking for ways to harden my edge, I found Document ID: 44541, Transit Access Control Lists: Filtering at Your Edge,  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml.

It was helpful, but a number of the ACL entries contained the operator/value

gt 1023,  i.e. access-list 110 permit udp any gt 1023 host <primary DNS server&gt; eq 53, access-list 110 permit tcp host bgp_peer gt 1023 host router_ip eq bgp, and access-list 110 permit tcp host bgp_peer eq bgp host router_ip gt 1023.

Since I also have a requirement to block ports, many of which are gt;1023,  I was wondering "what exactly does it do," "when do I need to use it," "why do I need it," and "how does it work?"

I know that it does work, I just need some information on the what, when, why and how.  I looked on the support community site, but found no real answer.  Can anyone shine some light on this for me?

Respectfully

Manny

[skarthic · Accepted solution]

Hello Manuel,

The ports 0 - 1023 are the well-known port numbers. These ports would be used by most of the network services. So based on application the device listens to one of these ports.(for ex.web server listen to port 80 ).

So the client who are trying to use these applications can contact with one of these port numbers (0 - 1023), as each of these ports have a specific purpose. So normally all clients that establish a TCP/UDP connection uses a port > 1023 while talking to the server.

Thats why use see using acls like

access-list 110 permit udp any gt 1023 host  eq 53

where  the DNS traffic is being permitted.

53 being the port of the DNS server

Since clients use a port > 1023, the ACL has been created likewise.

Hope to help.

Regards,
Ramani.

[manuel.dennis]

Thank you.

Regards

Manny