I'm embarrassed to have to ask this, but it's been so long since I have actually had to write an access list, I'm doubting myself. I have a 800 series router running IOS 12.4 which is used by a small business I occasionally do work for. The business has a /24 of live (non RFC1918) IPv4 addresses inside it which is used for numerous devices, which is delivered via ethernet from an ISP NTU. Most of them are secure enough that I don't worry about them, but they've just added a VoIP phone gateway which is completely insecure - beyond a password on the management interface - and even that is HTTP only (not even HTTPS). I want to put an access restriction on the interface which plugs into the ISP NTU to block everything except the authorised SIP host from connecting to the gateway - I know it's not perfect, but it's better than what is there now - while not interrupting access to any other devices. I've so far got this (Interface F4 is the incoming link from the ISP NTU) access-list 101 remark Blocks anything but SIP to Phone gateway access-list 101 permit ip host XXX.XXX.XXX.XXX host YYY.YYY.YYY.YYY access-list 101 deny ip any host YYY.YYY.YYY.YYY access-list 101 permit ip any any interface F4 ip access-group 101 in Will this permit only conenctions from XXX.XXX.XXX.XXX to the internal host YYY.YYY.YYY.YYY, and allow unfettered access to any other IP address on the inside? Or have I missed something? Thanks. ... View more

Folks. I've got (unfortunately) a third party installing some new networking kit for me, and I can;t get the connection to work. Basically, it's a 2921 connected to an ISP MPLS network on one port with a link into a switch on the other. Because we wanted to plan in advance for the days of VoIP, we asked them to put in two VLAN's - one for data, one for voice. For now, we've only activated one of them. The port config looks like this interface GigabitEthernet0/1 no ip address duplex auto speed auto ! interface GigabitEthernet0/1.10 description DATA VLAN encapsulation dot1Q 10 native ip address 10.50.70.254 255.255.255.0 My question to you leaned gents is - do they need the "native" statement on the end of the dot1q config line? The switch connecting to the router is a cheap-arse netgear, but it *is* VLAN capable, and supposedly capable of dot1q - and I've configured it with a single VLAN on the port in trunk mode - but I can't get the workstations hanging off the switch to connect. Does the "native" keyword mean the trunk passes ONLY untagged traffic (I.E. strips the VLAN tag from the traffic) which originates in VLAN 10 on the router, or does it mean that the port passes VLAN 10 traffic *and* untagged traffic? Thanks for any input. ... View more

Folks. I'm going nucking futs trying to get this to work - I know it's something stupidly simple, and I know I should remember how to do this, but it's been 10 years since I set one of these up from scratch, and it's been a long week. Work has an ADSL service - it's used for a backup in the event of a catostrophic failure of our normal infrastructure (in reality, it gets used for testing and not much else) which has been running on this crappy old billion router which fails about a dozen times a day. I've got a bunch of 887's hanging around from another project, so I finally went "Stuff it, I'm putting in an 887". I configured it, got it talking to ADSL, got it talking to the wireless point hanging off it, got the wireless working and getting IP allocation, I can telnet into the router and PING outside addresses - but I can't make NAT work for addresses on VLAN1. I plead for assistence. I don't care if you laugh in my face and say "Darren, you idiot, you forgot <this miniscule command>" I just need to fix it and get on with other things which I'm currently stressing about (don't get me started on integrating Juniper and Cisco, or Microsoft bl***dy Lync, trust me). Redacted/abbreviated config posted below - please, someone tell me what I've done wrong. version 15.0 hostname router no aaa new-model memory-size iomem 10 clock timezone AEST 10 clock summer-time ADST recurring 1 Sun Oct 2:00 1 Sun Apr 3:00 ! ip source-route ! ! ! ip dhcp pool 192.168.25.0/24    network 192.168.25.0 255.255.255.0    default-router 192.168.25.254    dns-server 139.130.4.4 203.50.2.71    lease 5 ! ! ip cef ip name-server 139.130.4.4 ip name-server 203.50.2.71 no ipv6 cef ! ! ! ! ip ssh version 2 ! ! ! ! ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface ATM0 no ip address ip virtual-reassembly no atm ilmi-keepalive pvc 8/35   encapsulation aal5snap   pppoe-client dial-pool-number 1 ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface Vlan1 description Local LAN ip address 192.168.25.254 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1420 hold-queue 100 out ! interface Dialer0 ip address negotiated ip mtu 1462 ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname <redacted> ppp chap password <redacted> ppp ipcp route default ! ip forward-protocol nd ip http server ip http secure-server ! ip nat source list 10 interface Dialer0 overload ! access-list 10 permit 192.168.25.0 0.0.0.255 dialer-list 1 protocol ip permit ! ! ! ! ! control-plane ! ! line con 0 no modem enable line aux 0 line vty 0 4 access-class 20 in exec-timeout 0 0 login local transport input telnet ssh ! ... View more

Learned Ladies & Gents. I have some 3750 switches which I am looking to deploy, but I'm not sure if my intended redeployment will work. I have one switch - the in-situ one, and the intended stack master - which is a WS-C3750X-48PF-S with the IPBASE feature set. I have several others which are about to be made redundant from their current location/jobs - WS-C3750X-24T-S with IPSERVICES feature set. Question is - can I add the 24 port switches into a stack with the 48 port switch as the master, given the different feature sets? I don't need, or expect, any of the advanced features from IPSERVICES to be active on this stack - it's a pure access switch, trunking to the core only, no fancy routing - but I'm running out of ports, and if I can add the soon-to-be remover 24 port switches into the stack it'd save me having to try and buy another 48 port switch to add into the stack. Thanks. ... View more