I have an 1800 isr that is running with port forwarding only. It is running a series of ip nat inside source static address port address port commands. It does not have an access list bound to the outside interface. This is working fine, but i am wondering if this is a security concern?
View 1 RepliesI implemented access list on cisco 3560 switch but it never works. I want to block access from network B to Network A and allow from Ato B
Network A. 10.0.12.0/24
Network B 10.0.24.0/24
The configuration is
interface Vlan1
description Data VLAN
[Code].....
I'm looking to implement a vlan filter to keep unnecessary stuff off my access-layer. Things like IPv6, IPX etc. I really only want IPv4, ARP and 802.1q on these 4500s. I know on 3750, 3560s etc, when I create the mac access-list, I can do it by ethertype, but on the 4500, I dont have that option.
4th_floor(config)#mac access-list extended Drop-traffic
4th_floor(config-ext-macl)#permit any any ?
protocol-family An Ethernet protocol family
<cr>
4th_floor(config-ext-macl)#permit any any protocol-family ?
appletalk
arp-non-ipv4
decnet
[Code]....
Extended IP access list VLAN20
10 permit tcp any any established
11 permit icmp any any
20 permit tcp any 192.168.20.0 0.0.0.255 eq 80
30 permit tcp any 192.168.20.0 0.0.0.255 eq 443
40 deny ip any any log
[code].....
Above is the network diagram and access list for VLAN 20 and VLAN 30, applied on incoming direction of each valn.But still able to access other port which is not on access list, tried changing the direction with no luck.Inter vlan routing is enabled on CoreSwitch default router is 192.168.10.10
i have one Cisco 3750, am using it as Core Switch where i have 6 more access switches are connected deirectly, and we are using VLANs in our network with the IP reange of 172.16.0.0 , now we had a new Internet connection which is dedicated to Exchange Server only.So we have TWO internet connection One for internet access to all users and another one for only Exchange Server.internet connection for the users is termiated at a Cisco 1700 Series Router and Internet for Exchage Server is terminated at a Cisco ASA Firewall.Now the problem is how can i write an access list, which says that all packets from Exchange server should be routed to ASA Firewall , and all other packets shoulde route to Cisco Router.IP address os Exchange server is 172.16.2.1, 172.16.2.2.
View 13 Replies View RelatedI have one computer connected to the 4506 that management does not want this PC to have access to anything on our network except our DHCP server and the one printer that resides on our network. I created an extended access list as follows. Our network is the 10.10.x.x and the external addresses the PC needs to access is 11.1.x.x. Once this PC is rebooted, it is unable to access DHCP to get the needed IP address it bounces back to a 169.x.x.x address and stops working.
Extended IP access list 2000
permit tcp host 10.10.200.242 host 11.1.200.1 (gateway)
permit tcp host 10.10.200.242 host 11.1.2.151 eq smtp (access from the pc to external server for smtp)
permit tcp host 10.10.200.242 host 11.1.2.149 eq 5721 (access from the pc to external server for remote access)
[ code]...
Then I applied the access-group 2000 on the interface the PC is connected to. What am I missing for DHCP to work and for this PC to always get the ip address that is reserved?
I am trying to harden my Nexus box and I am not able to ACL assigment command. Following are the commands I am trying to add.
interface cmp-mgmt module 5
Ip access-group NETWORK_MANAGEMENT_ACCESS in
I configure multiple static RPs and one of the ACLs denies a source will it move on to the next entry that covers it in another acl? [code] i.e. 1.1.1.1 will be used as the RP for 224 to 238 and 2.2.2.2 will be used as the RP for 239.Will that work correctly, i.e. if a source is trying to register with the router and its for the group 239.1.1.1, will it be denied against the first RP and then permitted against the second RP?
View 2 Replies View RelatedI have a layer 3 switch, 3550.I have several vlans on there just for playing around with. One of the vlans, has a vonage linksys box attached to it with a UK number attached. From time to time telemarketers call at 03:00 in the morning, this as I'm sure you can imagine is not much fun. The linksys box gets 192.168.3.3 as it's ip.The switch is connected to a non cisco router at 192.168.0.1
interface FastEthernet0/24
no switchport
ip address 192.168.0.2 255.255.255.0
I was thinking a time based access list would work best I have tried several variations but the phone still rings. I have tried access-list 1 deny host 192.168.3.3 permit ..... and more extensive lists but the phone still rings. I have not applied the time-range yet, so that's not the problem.I have applied the list to the vlan interface and to fa0/24 but it's not working.
I have a LIII Switch Cisco 3750x ,with diffrent Vlans , Some users are in Vlan 102 (10.10.2.0) and Some Users are in Vlan1 (10.10.1.0) , now i want to restrict the Vlan102 users to access Vlan1 , i am pasting my configuration below , how to create a access list .
interface Vlan1
ip address 10.10.1.36 255.255.255.0
ip helper-address 10.10.1.36
[Code].....
I need to enable/disable a mac access-list on a 2960 scheduled by time. The switch has lanbasek9-mz.122-44.SE6. As the mac access-list can not support time ranges, I tried EEM but seems like it is not supported in this device.
View 1 Replies View RelatedIn my core Switch,there are 2 v LAN(V LAN 1 & V LAN 2)my switch is Cisco 4948,so be default ip routing is enable in it. My all servers (DHCP,HTTP,HTTPS) are in v LAN 1 & internet is also in v LAN 1.
My requirement is that v LAN 1 user should not communicate with the v LAN 2 and vice versa. But the v LAN 2 users need an access of all servers and internet which is in v LAN 1. How to configure the access-list. I have try on Packet tracer which i have attached.
note:v LAN 2 user should get the IP from dhcp server which is in vlan1.
We have a gateway on a 4503, say on port 2/1, and we only want the other devices that are plugged into the 4503 to be able to talk to the gateway and thats it. The other devices are Motorola TUT DSL devices and they plug into the 4503 directly.
Normally "switchport protected" would make this very easy to keep stuff on one port from talking to other ports but with 4500's you are not able to do that command. So we implemented a MAC Access-List Extended ACL. Here is what we did
mac access-list extended BLAH
permit #host 0000.XXXX.YYYY any
interface range fa 2/5 - 20
mac access-group BLAH out
The MAC address 0000.XXXX.YYYY is the MAC address of the gateway that is plugged into Fa2/1 and the DSL TUT devices are plugged into ports Fa2/5-20. We would think that this config would only allow devices on the TUT DSL to talk only to the Gateway but we don't really think this is happening. The TUT devices are learning about MAC addresses that are on other TUT devices.
I have 3 3560 switches which are configured with trunks between them. They run vlan 10, 11 & 12. I have a 'core' switch (switch 1) of these 3 to which an MPLS router is connected on vlan12. I in addition have another switch hanging off the 'core' switch via a routed link (switch 4). I have EIGRP configured as a stub and as such the IP address on the routed link at the core switch end is of a /24 from v lan 1 on the other switch. This makes the route directly connected and therefore distributed via EIGRP stubs. Switch 1 is then exchanging routes with the MPLS router (via EIGRP).
The problem I have is that from any sub net on any switch (switch 1, 2 or 3) I can ping 192.168.13.1 (switch 4). When I try and ping switch 4 from over the MPLS I am unable to. If I trace to the switch I see it reaches the outside of the MPLS router, but is then unresponsive. The same applies if I try to ping switch 1 on 192.168.13.2. Any of the other IP addresses of switch 1 respond.
The MPLS network is a managed solution to which I have no access. I'm told that the MPLS provider is able to ping switch 1 & switch 4 on the 192.168.13.x addresses from a remote router (192.168.32.2). I have tried from a switch on the same L2 sub net (192.168.32.1) and I don't get a response.
From switch 4 I am able to ping the switch on 1 of it's interfaces (192.168.19.1), but not the interface I mentioned above 192.168.32.1. There are no access lists in place on the switches and no firewalls between the sites.
Not sure why the N7K M1 card doesn't take this command. It works on other N7K at different site. [code]
View 1 Replies View RelatedI have two 5548's in sync mode: I have an existing ACL and I want to add a new line to it, but after I do and try to commit it states the verify failed. [code]
I have to add access list to both switches not in config sync mode.
I am using cisco 1841 LAN router, I need to block MAC address i have applied the command access-list 1102 deny 0000.0000.0000.0000 mac address..... but it does not work.
View 24 Replies View RelatedI'm getting this error message on syslog server (Kiwi syslog)access-list logging rate-limited or missed XXXX packets i did the following commands but still I'm getting the error :logging buffered 16386 debugginglogging rate-limit all 5000no logging consoleno logging monitorip access-list logging interval 30000ip access-list log-update threshold 30000 i don't want to report to the console or monitor i want to report direct to syslog server, because I'm monitoring all the traffic (permit ip any any log) !
View 2 Replies View RelatedI have aaa new model configured on a number of isr's(1800, 1900, 2900, 3800 etc). When i have aaa configured, the telnet logins use that authentication and not the password in the line vty portion. Is this by design. would disabling aaa enable both telnet and aaa authentications, essentially making it a dual login.
View 3 Replies View RelatedI am new user of cisco router i can access the hardware and login in the account but the problem is if i use the command "enable" asking for a password, old I.T. personnel who setup this router already resign.
View 2 Replies View RelatedI would like to configure IP SLA with ICMP tracker. What is the minimum IOS & Feature required in cisco 1800 Router?
View 2 Replies View RelatedI have strange problem with 1800 router , I can't see any debug messaging , the ping from PC to this router is Ok , but no icmp debug appears , even I enable "debug ip icmp " the version of router is : C181X Software (C181X-ADVENTERPRISEK9-M), Version 12.4(6)T6
View 2 Replies View RelatedI've just started out playing with a Cisco 1800 router to gain some knowledge of Cisco devices before taking a CCNA. I also have a 2950 switch but will start with the router.
I'm using an Android phone as a wireless Internet access point. This issues IP addresses by DHCP in the 192.168.43.x range with 255.255.255.0 subnet.
Also I have a Linksys WRT54G router running DD-WRT firmware acting as a wireless bridge to the Android phone, and it has 4 LAN ports.
This bridge is up and running and I have successfully connected my laptop to the Linksys for testing and can use the Internet provided by the phone.
Connected to the Linksys is a Cisco 1800 router. Connected to the router is my Citrix XenServer PC and a NAS box.
The XenServer and NAS are on another network 07.05.19.x range with 255.0.0.0 subnet using their own static IPs. One of the virtual clients on the XenServer will be a DHCP server to service other virtual clients. All still in the 07.05.19.x range.
Basically I want the devices on the 07.05.19.x IP range to be able to use the Internet gateway at 192.168.43.1 to access the Internet.
How would I set up my 1800 to achieve this?
Also, am I right in understanding that the 1800 will ignore DHCP leases from the Android phone due to it being a Layer 3 device.
I setup a GRE tunnel between two cisco 1800 & 1900 routers. I can't received multicast.
Here is a copy of my configs:
R3#Building configuration...
Current configuration : 1238 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R3!boot-start-markerboot-end-marker!logging message-counter syslog!no aaa new-modeldot11 syslogip source-route!ip cefip multicast-routing no ipv6 cef!multilink bundle-name authenticated!archivelog config hidekeys! interface Loopback0ip address 10.0.0.3 255.255.255.255!interface Tunnel0ip address 192.168.24.2 255.255.255.252ip pim sparse-modetunnel source Loopback0tunnel destination 10.0.0.1!interface FastEthernet0/0ip address 10.0.3.1 255.255.255.0ip pim sparse-modeduplex autospeed auto!interface FastEthernet0/1ip address 192.168.23.2 255.255.255.252ip pim sparse-modeduplex autospeed auto!interface Serial0/0/0no ip addressshutdownno fair-queueclock rate 2000000! router eigrp 1network 10.0.0.3 0.0.0.0network 10.0.3.1 0.0.0.0network 192.168.23.2 0.0.0.0no auto-summary!ip forward-protocol ndno ip http serverno ip http secure-server!control-plane!line con 0line aux 0line vty 0 4exec-timeout 5 0privilege level 15no login!scheduler allocate 20000 1000end
[code]....
I want to send a particular data stream (source-A destination-B) through only one of two WAN routers to a remote site. The remote site also has two WAN routers. Traffic from source-A will travel through a core and distribution layer of 6500 L3 switches, running 12.2(33)SXH8, to the WAN routers which are two ASR1006s. The remote end is the same - two ASR1006 WAN routers to 6500 distribution and Core L3 switches. All 6500s are L3 uplinked to each other and to the WAN routers. All traffic from the local site to the remote site routes throuh only one of the two WAN routers. I want to move only traffic from source-A to source-B to the second WAN router to the remote site.
Would it be best to use policy-based routing or an offset list of some sort to accomplish this? I've done PBR before where you just hand off traffic described in an ACL to a particular outbound port and basically hand carry the traffic to a point in the network where EIGRP prefers the route you want.
ASA 5505 vlans routing & access-list?
View 4 Replies View RelatedHow can i create an top 10 list of the most popular website that users connect to through the ASA Firewall.
i have enabled HTTP inspect, and setup an Syslog server (S plunk), that collects all HTTP entries in the log, but i don't know how, to create an top list in s plunk.(don't if it is possible)
is there a better way to do this ? e.g. URL filter with web scene or IPS
I'm trying to create a route-map for an EIGRP Distribute list on a N7K, the goal is to not advertise a 10.0.0.0/8 and 172.31.30.20/32 networks out a link to a remote site while permitting all other traffic to the internet (default). I configured the ACL/route-maps below and applied them outbound on the N7K interface but no subnets at all are being received on the remote site router.
ip access-list DENY_10.0.0.0
10 permit ip any 10.244.244.20/30 <<--WAN interface network
20 deny ip any 10.0.0.0/8
25 deny ip any 172.31.30.20/32
30 permit ip any any
[code]....
Cisco 881W WLAN module running in autonomous mode. How do I list connected wireless clients?
View 1 Replies View RelatedHave C3750 Version 12.2(25r)SEE3 , Trying to run:
kron policy-list backup
cli write cli copy running-config tftp://xx.xx.xx.xx/swi06-confg
kron occurrence backup at 22:00 Mon recurring
policy-list backup
There are nothing backup and nothing in the log.
If i fully populate all switch port (Cisco 3750 series) with 100 filter list on each port is it recommendable.
View 4 Replies View RelatedIm trying to simulate a switch in Gns3 and i use 16ESW module in a cisco 3700 router. why im getting this record after i try to filter which vlans pass through my trunk port:Router(config-if)#switchport trunk allowed vlan 2,3,4 Command rejected: Bad VLAN allowed list. You have to include all default vlans, e.g. 1-2,1002-1005.
View 6 Replies View RelatedCan i use acl object group with wccp redirect list?My platforms are 6500 and isr 2921
View 1 Replies View Related