question about firewall syntax on cisco ios

[willchap86]

hey guys I am messing around with a cisco ios switch and firewall syntax for the first time.

I am just trying to figure out if my syntax is correct before I actually go on and do this for a business switch

Currently, I am trying to: (also, this is being taken place in a area border router )

1. Allow SSH (tcp destined to port 22) from 
    10.0.0.0/8
    131.11.11.11/32 (fake ip)
   into my entire network (10.25.0.0/16). 

2  Disallow all other SSH (tcp destined to port 22) to MY network.
3  Allow all other traffic inbound to my network.

   and I am implementing this on my border routers

Extended IP access list 100
    100 permit tcp 10.0.0.0 0.255.255.255 host 10.25.0.0 eq 22
    200 permit tcp host 131.11.11.11 host 10.25.0.0 eq 22
    300 deny tcp any host 10.25.0.0 eq 22
    400 permit ip any host 10.25.0.0
    999 permit ip any 10.25.0.0 0.0.255.255

Now, for rule 400 - would this be correct syntax to allow all other traffic inbound to my network?

And for rule 999 - I want to permit all other traffic (that is not tcp to port 22 to your network) is this correct?

thanks a bunch guys

[Jon Marshall]

This is not firewall syntax, it is just an acl.

But assuming that is what you are trying to do there are a couple of things wrong -

1) all lines except the last one refer to "host 10.25.0.0".

This can't be right as it is not as host address and based on your requirements you want to allow it to your entire network so the destination in your acl lines should be the same as the last ie. "10.25.0.0 0.0.255.255"

2) line 400 isn't needed because as above the host part isn't right and the last line allows all IP to your network.

Do you actually want to restrict access to certain hosts ?

Jon

[willchap86]

hey jon! Thank you so much for the reply!! Oh, so adding host is wrong? Yeah, I am actually trying to involve the whole 10.25.0.0 network. So I need to add the wildcard bitmap, correct?

[Jon Marshall · Accepted solution]

Yes, each entry needs to have "10.25.0.0 0.0.255.255" instead of the host part, just like your last line.

And also like I say line 400 isn't needed as long as you still have the last line as it would simply be a copy of it.

Jon

[willchap86]

thanks so much buddy!