Troubleshooting interface traffic on port 120 using access-list mapped to interface

[getaway51]

Hi,

I have a WAN interface Gi0/0.

May I know I i wanted to check outgoing and incoming traffic in port 120, how does the inout/output config of access-list mapped to interface looks like? The objective is to prove tht router is forwarding traffic via port 120. I guessed also to prove other side (202.155.0.0/17 or ANY) is not sending traffic over via port 120 as well. 

Traffic Output

Source is WAN interface IP or exact IP is needed?

Destination is 202.155.0.0/17

Port is 120

Traffic Input

Source is 202.155.0.0/17 or ANY

Destination is Gi0/0 or exact IP is needed?

Port is 120

Many thanks guys!

[Giuseppe Larosa]

Hello @getaway51 ,

in writing IP ACLs even extended we need to use IP addresses

The second important aspect is that the port 120 has to follow the server side

So if the traffic is originated from your GE IP address TCP port 120

access-list 110 remark outgoing ACL

access-list 110 permit tcp host <Gi0/0-IP-address> eq 120 202.155.0.0 0.0.127.255

access-list 110 permit ip any any

access-list 111 remarki inbound ACL

access-list 111 permit tcp 202.155.0.0 0.0.127.255 host <Gi0/0-IP-address> eq 120

access_list 111 permi ip any any

if the TCP server were in the 202.155.0.0/17 the position of the eq 120 would be reversed (as noted above it follows the server side)

you then apply the ACLs to your GE

interface gi0/0

ip access-group 110 out

ip access-group 111 in

Hope to help

Giuseppe

[getaway51]

Hi,

If unsure it is udp or tcp, can we apply both udp and tcp in the ACL like below?

access-list 111 remarki inbound ACL

access-list 111 permit tcp 202.155.0.0 0.0.127.255 host <Gi0/0-IP-address> eq 120

access-list 111 permit udp 202.155.0.0 0.0.127.255 host <Gi0/0-IP-address> eq 120

access_list 111 permi ip any any

Thanks!!

[Giuseppe Larosa]

Hello @getaway51 

yes you can  one line for TCP one line for UDP and the explicit permit any to avoid to black hole all other traffic.

Hope to help

Giuseppe