Cisco Switching/Routing :: 4503 -MAC Access-list Extended To Only Allow Gateway Traffic

Nov 7, 2011

We have a gateway on a 4503, say on port 2/1, and we only want the other devices that are plugged into the 4503 to be able to talk to the gateway and thats it.  The other devices are Motorola TUT DSL devices and they plug into the 4503 directly.
 
Normally "switchport protected" would make this very easy to keep stuff on one port from talking to other ports but with 4500's you are not able to do that command.  So we implemented a MAC Access-List Extended ACL.  Here is what we did
 
mac access-list extended BLAH
permit #host 0000.XXXX.YYYY any
interface range fa 2/5 - 20
mac access-group BLAH out 
 
The MAC address 0000.XXXX.YYYY is the MAC address of the gateway that is plugged into Fa2/1 and the DSL TUT devices are plugged into ports Fa2/5-20.  We would think that this config would only allow devices on the TUT DSL to talk only to the Gateway but we don't really think this is happening.  The TUT devices are learning about MAC addresses that are on other TUT devices. 

View 1 Replies


ADVERTISEMENT

Cisco WAN :: 7200 VXR - Named Extended Access List

Oct 10, 2012

I've got a 7200 vxr that I'm trying to create a named extended access-list in.
 
I got to configure it if I go into ip after that the only commands available for access-list are log-update, logging, and re sequence.
 
so if I go back to the main config menu access-list is an available command
 
but then from the main config menu, if I type: access-list extended eth0_in it says invalid input detected at the carrot marker which is under the first character of the work extended.
 
also, at the main config menu, if I type: ip access-list extended eth0_in it again give me the invalid input detected at the word extended.
 
I don't understand what I am missing to get this to work.

View 9 Replies View Related

Cisco Firewall :: Configure Extended Access List On AS5350XM?

Sep 14, 2011

I'm trying to configure an extended access list on one AS5350XM but I get one way hearing on a voice calls and I can't determine why (please see the attached diagram). There is an OSPF running on both gigabit interfaces and the Loopback address is also advertised (it is actually the voip IP address). The access list is applied on both interfaces in the inbound direction. There is another gateway with IP:4.4.4.4 (no firewalls here) and the routing between gateways is working properly.
 
Here is part of the access list (applied on AS5350):

.
.
permit ip host 4.4.4.4 host 3.3.3.3
.
.
 
When I review the log of the AS5350xm I see many errors like this one:

%SEC-6-IPACCESSLOGP: list example denied udp 3.3.3.3(16638) -> 4.4.4.4(18094), 1 packet
 
So how it is possible to see this error since the access list is in inbound direction and the IP address (4.4.4.4) is open. I don't have problems when I do telnet or ssh from 3.3.3.3 to 4.4.4.4.

View 3 Replies View Related

Cisco Switching/Routing :: 4503 Blocking Usage Of Duplicate Default Gateway IP By Rogue Attacker

May 16, 2012

We had a core switch (4503), distribution switches and access in our network and consists of many vlans. Almost all vlans uses DHCP Pools. But for few vlans DHCP is not yet configured. Recently one of the rogue user in vlan 1 gave the corresponding interface vlan ip of core switch (gateway) as his ip and caused a prolonged network outage for the vlan. Any way we are going to seggregate vlan 1 into different vlans, but before that we need a temporary plan to block such kinds of attack.What are the possible ways we can avoid the network outage problem even if a user gave the gateway ip to the machine?

View 3 Replies View Related

Cisco Firewall :: 5540 - Extended Access-list Error Using FQDN

Nov 7, 2011

I'm trying to add an access-list rule to allow internal servers to connect an outside host on a asa 5540. The hostname translates to multiple ip's. Normally I just lookup the ip address or one of the ip's the hostname translates too and use that in the access-list as the host. For some reason the actual ip's, which are a few, are not always available so using a specific ip sometimes does not work, thus the reason I have to use the hostname instead of the ip. I have 2 hostnames. www.hostname.com and subdomain.hostname.com.
 
This is how I normally add these rules (the ip addresses are fictive): access-list internet_access extended permit tcp host 192.168.50.5 host 84.115.57.121 eq www log
 
When I try to add this using the hostname on our asa I get an error: access-list internet_access extended permit tcp host 192.168.50.5 host www.hostname.com  ?ERROR: % Unrecognized command
 
I've tried it without the 'www', so hostname.com but same error.

View 4 Replies View Related

Cisco Switching/Routing :: 4503 / 3560X - Core And Access Switches In IPTV Network Infrastructure?

Jul 8, 2012

recommend a cisco core switch and access switches in IPTV network infrastructure?I was ask to implement a network for IPTV system but i don't have idea what will be the model i will use.
 
Core Switch = Cisco 4503
Access Switches = Cisco 3560X

View 3 Replies View Related

Cisco :: AS5400 SIP Gateway And Access-list Control?

Feb 3, 2011

I have a sip gateway (AS5400) that is used to connect sip providers to our internal voice network.Internal gateway (10.1.1.2 LAN) -- SIP trunk -- AS5400 (10.1.1.3 LAN/ 8.23.23.43 WAN) -- SIP trunk -- Internet SIP Provider We encountered the following problem :A SIP call from internal gateway to the sip provider could establish but was muted on our side (sip provider could hear us)On the WAN interface of the AS5400, there is a ACL that filter traffic IN coming from SIP Provider

interface GigabitEthernet0/0
ip address 8.23.23.43 255.255.255.224
ip access-group 101 in

I log the deny on this ACL and I saw some udp packets denied with LAN addresses !*Mar 3 15:24:44.001: %SEC-6-IPACCESSLOGP: list 101 denied udp 10.1.1.3(0) -> 10.1.1.2 (0), 1 packet I did not bind anything on the sip config.When I changed the ACLs, calls went well.Why do I see LAN packets on the WAN interface ?

View 1 Replies View Related

Cisco Switching/Routing :: 3560 - Access List On InterVLan Routing

Dec 11, 2012

I implemented access list on cisco 3560 switch but it never works. I want to block access from network B to Network A and allow from Ato B
Network A. 10.0.12.0/24
Network B 10.0.24.0/24
 
The configuration is
interface Vlan1
description Data VLAN

[Code].....

View 14 Replies View Related

Cisco Switching/Routing :: 4500 And Mac Access List

Apr 11, 2011

I'm looking to implement a vlan filter to keep unnecessary stuff off my access-layer. Things like IPv6, IPX etc. I really only want IPv4, ARP and 802.1q on these 4500s. I know on 3750, 3560s etc, when I create the mac access-list, I can do it by ethertype, but on the 4500, I dont have that option.
 
4th_floor(config)#mac access-list extended Drop-traffic
 
4th_floor(config-ext-macl)#permit any any ?
  protocol-family  An Ethernet protocol family
  <cr>
 
4th_floor(config-ext-macl)#permit any any protocol-family ?
  appletalk
  arp-non-ipv4
  decnet
[Code]....

View 1 Replies View Related

Cisco Switching/Routing :: 1800 ISR Without Access List?

Apr 19, 2012

I have an 1800 isr that is running with port forwarding only.  It is running a series of ip nat inside source static address port address port commands.  It does not have an access list bound to the outside interface.  This is working fine, but i am wondering if this is a security concern?

View 1 Replies View Related

Cisco Switching/Routing :: 192.168.10.10 / VLAN Access List Not Working?

Sep 5, 2012

Extended IP access list VLAN20
    10 permit tcp any any established
    11 permit icmp any any
    20 permit tcp any 192.168.20.0 0.0.0.255 eq 80
    30 permit tcp any 192.168.20.0 0.0.0.255 eq 443
    40 deny ip any any log

[code].....
 
Above is the network diagram and access list for VLAN 20 and VLAN 30, applied on incoming direction of each valn.But still able to access other port which is not on access list, tried changing the direction with no luck.Inter vlan routing is enabled on CoreSwitch default router is 192.168.10.10

View 5 Replies View Related

Cisco Switching/Routing :: 3750 How To Write Access List

Jan 15, 2012

i have one Cisco 3750, am using it as Core Switch where i have 6 more access switches are connected deirectly, and we are using VLANs in our network with the IP reange of 172.16.0.0 , now we had a new Internet connection which is dedicated to Exchange Server only.So we have TWO internet connection One for internet access to all users and another one for only Exchange Server.internet connection for the users is termiated at a Cisco 1700 Series Router and Internet for Exchage Server is terminated at a Cisco ASA Firewall.Now the problem is how can i write an access list, which says that all packets from Exchange server should be routed to ASA Firewall , and all other packets shoulde route to Cisco Router.IP address os Exchange server is 172.16.2.1, 172.16.2.2.

View 13 Replies View Related

Cisco Switching/Routing :: 4506 - Interface Access-list

Nov 14, 2011

I have one computer connected to the 4506 that management does not want this PC to have access to anything on our network except our DHCP server and the one printer that resides on our network.  I created an extended access list as follows.  Our network is the 10.10.x.x and the external addresses the PC needs to access is 11.1.x.x.  Once this PC is rebooted, it is unable to access DHCP to get the needed IP address it bounces back to a 169.x.x.x address and stops working.
 
Extended IP access list 2000
permit tcp host 10.10.200.242 host 11.1.200.1                           (gateway)
permit tcp host 10.10.200.242 host 11.1.2.151 eq smtp              (access from the pc to external server for smtp)
permit tcp host 10.10.200.242 host 11.1.2.149 eq 5721              (access from the pc to external server for remote access)
[ code]...
 
Then I applied the access-group 2000  on the interface the PC is connected to. What am I missing for DHCP to work and for this PC to always get the ip address that is reserved?

View 3 Replies View Related

Cisco Switching/Routing :: 3750 - Extended Ping With Df Bit Set

Mar 5, 2012

I am trying to test the MTU between two 3750 switches I have in the lab.  I've set the MTU with the command "system mtu 9000" on both switches and rebooted.
 
The only connections on the switches are the gig ports connecting the two switches.  Each interface is  a member of vlan 1.
 
I am doing an extended ping.  I set the datagram size to 2000.  When the df bit is set the ping doesn't go through.  If the DF bit is not set the ping goes through.
 
The debug ip icmp shows, 4d00h: ICMP: dst (1.1.1.1): frag. needed and DF set.
 
Why is fragmentation needed when the MTU is set to 9000?
  
GigabitEthernet1/0/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0015.2b7d.0d01 (bia 0015.2b7d.0d01)
MTU 9000 bytes, BW 1000000 Kbit, DLY 10 usec,

[Code].....

View 4 Replies View Related

Cisco :: Access List To Permit IP's Instead Denies All Traffic?

Feb 16, 2011

I'm new to this forum and Cisco in general but I feel it may be very resourceful to me as I am a new network administrator fresh out of school for a local credit unionHere's my situation:We need to limit access to one of our servers to only 3 workstations used by our IT department. The server is on a Cisco 3560G on port 17, which is the interface I'm trying to apply a standard, basic ACL to, which looks like this:

View 10 Replies View Related

Cisco WAN :: 6509 / Classify IS-IS Traffic With Access List?

May 16, 2012

I'm configuring Control Plane Police in a Catalyst 6509. This equipment is using IS-IS like its IGP routing protocol, and iBGP. In order to make CoPP work Im classifying the traffic entering the control plane like CRITICAL, IMPORTANT, NORMAL, UNDESIRABLE and DEFAULT. Obviously routing protocol traffic must be classified like CRITICAL. Doing so is easy to BGP because it runs over TCP/IP and I can configure the following access list to classify BGP:
 
ip access-list extended CP-CRITICAL-IN
remark #### CONTROL PLANE CRITICAL TRAFFIC INBOUND ####
remark #### ROUTING TRAFFIC - BGP ####
permit tcp host [BGP neighbor addr] eq bgp host [local BGP addr]
permit tcp host [BGP neighbor addr] host [local BGP addr] eq bgp
deny   ip any any
 
But IS-IS is also a CRITICAL traffic,  but IS-IS doesn't run over TCP/IP, rather it exchange its own PDUs. So, how do I classify IS-IS traffic with an access list?

View 3 Replies View Related

Cisco Switching/Routing :: Not Able To Assign Access List To CMP Interface Of Nexus 7K

Feb 6, 2013

I am trying to harden my Nexus box and I am not able to ACL assigment command. Following are the commands I am trying to add.

interface cmp-mgmt module 5
Ip access-group NETWORK_MANAGEMENT_ACCESS in

View 1 Replies View Related

Cisco Switching/Routing :: 239 Multiple Static RPs And Access-list Behavior

Aug 14, 2012

I configure multiple static RPs and one of the ACLs denies a source will it move on to the next entry that covers it in another acl? [code] i.e. 1.1.1.1 will be used as the RP for 224 to 238 and 2.2.2.2 will be used as the RP for 239.Will that work correctly, i.e. if a source is trying to register with the router and its for the group 239.1.1.1, will it be denied against the first RP and then permitted against the second RP?

View 2 Replies View Related

Cisco Switching/Routing :: 3550 / Access List - Block One Ip Or Port

Jan 9, 2012

I have a layer 3 switch, 3550.I have several vlans on there just for playing around with. One of the vlans, has a vonage linksys box attached to it with a UK number attached. From time to time telemarketers call at 03:00 in the morning, this as I'm sure you can imagine is not much fun. The linksys box gets 192.168.3.3 as it's ip.The switch is connected to a non cisco router at 192.168.0.1
 
interface FastEthernet0/24
no switchport
ip address 192.168.0.2 255.255.255.0
 
I was thinking a time based access list would work best I have tried several variations but the phone still rings. I have tried access-list 1 deny host 192.168.3.3 permit ..... and more extensive lists but the phone still rings. I have not applied the time-range yet, so that's not the problem.I have applied the list to the vlan interface and to fa0/24 but it's not working.

View 3 Replies View Related

Cisco Switching/Routing :: Vlan Access List In 3750x Switch

Feb 6, 2013

I have a LIII Switch Cisco 3750x ,with diffrent Vlans , Some users are in Vlan 102 (10.10.2.0) and Some Users are in Vlan1 (10.10.1.0) , now i want to restrict  the Vlan102 users to access Vlan1 , i am pasting my configuration below , how to create a access list . 
 
interface Vlan1
ip address 10.10.1.36 255.255.255.0
ip helper-address 10.10.1.36

[Code].....

View 2 Replies View Related

Cisco Switching/Routing :: 2960 - Mac Access-list Time Based

Dec 11, 2011

I need to enable/disable a mac access-list on a 2960 scheduled by time. The switch has lanbasek9-mz.122-44.SE6. As the mac access-list can not support time ranges, I tried EEM but seems like it is not supported in this device.

View 1 Replies View Related

Cisco Switching/Routing :: 4948 - Configuration Of Access List For VLAN 2

May 19, 2013

In my core Switch,there are 2 v LAN(V LAN 1 & V LAN 2)my switch is Cisco 4948,so be default ip routing is enable in it. My all servers (DHCP,HTTP,HTTPS) are in v LAN 1 & internet is also in v LAN 1.

My requirement is that v LAN 1 user should not communicate with the v LAN 2 and vice versa. But the v LAN 2 users need an access of all servers and internet which is in v LAN 1. How to configure the access-list. I have try on Packet tracer which i have attached.
 
note:v LAN 2 user should get the IP from dhcp server which is in vlan1.

View 4 Replies View Related

Cisco WAN :: 2851 - VPN Traffic Not Captured By IPSec Access List

Aug 29, 2012

we have two 2851's.  One in Australia, one in NZ, IPsec VPN between the two.
 
We have multiple subnets behind the tunnels. From all the sunbets in Aus we can reach all the subnets in NZ, except for one.  From NZ we can reach all the subnets in Aus.  The traceroute and pings from the subnet in question in Aus goes out the internet interface of the router instead of going into the tunnel.
 
The subnets in question are 10.110.220/24 (Aus), 10.110.250/24 (NZ)
 
The access lists at both ends cover the traffic required but for some reason when leaving Australia the traffic is not captured by:
 
Crypto Map "AUS-SYD" 20 ipsec-isakmp
Description: Auckland VPN
Peer = 203.167.249.46

[Code].....

View 3 Replies View Related

Cisco Switching/Routing :: 3560 - No Access List On Switches And No Firewall Between Sites

Jul 15, 2012

I have 3 3560 switches which are configured with trunks between them. They run vlan 10, 11 & 12. I have a 'core' switch (switch 1) of these 3 to which an MPLS router is connected on vlan12. I in addition have another switch hanging off the 'core' switch via a routed link (switch 4). I have EIGRP configured as a stub and as such the IP address on the routed link at the core switch end is of a /24 from v lan 1 on the other switch. This makes the route directly connected and therefore distributed via EIGRP stubs. Switch 1 is then exchanging routes with the MPLS router (via EIGRP).
 
The problem I have is that from any sub net on any switch (switch 1, 2 or 3) I can ping 192.168.13.1 (switch 4). When I try and ping switch 4 from over the MPLS I am unable to. If I trace to the switch I see it reaches the outside of the MPLS router, but is then unresponsive. The same applies if I try to ping switch 1 on 192.168.13.2. Any of the other IP addresses of switch 1 respond.
 
The MPLS network is a managed solution to which I have no access. I'm told that the MPLS provider is able to ping switch 1 & switch 4 on the 192.168.13.x addresses from a remote router (192.168.32.2). I have tried from a switch on the same L2 sub net (192.168.32.1) and I don't get a response.
 
From switch 4 I am able to ping the switch on 1 of it's interfaces (192.168.19.1), but not the interface I mentioned above 192.168.32.1. There are no access lists in place on the switches and no firewalls between the sites.

View 22 Replies View Related

Cisco Switching/Routing :: CAT3750E No Longer Use Multiple Ports Within Extended ACL

Mar 12, 2012

I was wondering why can't we no longer use the multiple ports within an extented ACL like I use to do it in a CAT3750E.I have IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.02.00.SG.I wanted to create an ACL like so [code] But when I do, it tells me that I cannot do it.... I can only add 1 tcp port to my ACL line. I tried to search the "object-group" concept also but it's not implemented in this IOS.Can this be done in IOS-XE ?I'm migrating my enviroment from a CAT3750E stack to a C4510-E.

View 1 Replies View Related

Cisco Switching/Routing :: 3560 / Creating Extended VLans And Subinterface?

Jan 24, 2013

We have a 3560 switch running IOS universalk9-mz.150-1.SE3.bin.Recently, we saw two problems with this switch:-
 
1. if we try to enable subinterface on any routed interface , for eg. gig1/1, it says invalid input detected. It doesnt accept encapsulation command also.   Following was done to enable subinterface: 

   int gig1/1
  no ip address 
  int gig1/1.2000
  ip address 1.1.1.1
 
under the gi1/1.2000 subinterface, it doesnt present the option of ip address.
 
2. we created a layer 2 vlan 2000 like:   vlan 2000 When we do an exit after creating this vlan , it gives following error:-
 
%SW_VLAN-4-VLAN_CREATE_FAIL: Failed to create VLANs 2000: extended VLAN(s) not allowed in current VTP mode

View 6 Replies View Related

Cisco Switching/Routing :: Radius-server Attribute 61 Extended On ASR1004

Nov 9, 2011

We faced with problem after upgrade ASR from 12(2) 33 XNE2. I know that this is an old XE release but our Radius deny authization from ASR with more new XE version. Here is our radius attribute configuretion:
 
!
radius-server attribute 44 include-in-access-req
radius-server attribute nas-port format d
radius-server host x.x.x.x auth-port 1812 acct-port 1813 non-standard

[Code]....

How can I add in my configuration that ASR send necesserry NAS-Port-Type - VPDN

I couldn't found out any info ((( for radius-server attribute 61 extended

View 1 Replies View Related

Cisco WAN :: 2811 Remove Access-list Applying To Inbound Traffic

Dec 25, 2012

I have been trying to figure out a NAT issue on my 2811 and the inspect engine.I have 'ip inspect FW out' on my outside interface. If I turn it off, I also have to remove the access-list applying to inbound traffic on that same interface. Why is that? This whole thing centered around SIP registrations from devices on my LAN to my provider. The provieder is showing that I am registering from a high end port (1024 or something crazy). He said that it sounds like some type of SIP ALG or something on my router. For the life of me, I can't figure out what would be causing it. I am just using a standard route-map that points to the outside interface using 'overload'.

View 6 Replies View Related

Cisco Switching/Routing :: N7K Hardware Access-list Resource Pooling Command Not Working

Nov 23, 2011

Not sure why the N7K M1 card doesn't take this command. It works on other N7K at different site. [code]

View 1 Replies View Related

Cisco Switching/Routing :: 5548 Add Access List To Both Switches Not In Config Sync Mode

Mar 21, 2012

I have two 5548's in sync mode: I have an existing ACL and I want to add a new line to it, but after I do and try to commit it states the verify failed. [code]

I have to add access list to both switches not in config sync mode.

View 1 Replies View Related

Cisco Switching/Routing :: 1841 Need To Block MAC Address / Applied Command Access-list

Sep 4, 2012

I am using cisco 1841 LAN router, I need to block MAC address i have applied the command access-list 1102 deny 0000.0000.0000.0000 mac address..... but it does not work.

View 24 Replies View Related

Cisco Switching/Routing :: Catalyst 4505 - Write Extended ACL For Voice VLan

May 14, 2012

I am trying to write an extended ACL for the voice vlan.My scenario is the following:I have two PBXs with two Catalyst 4505 L3 switches.The C4505 are connected trough a trunk link.I have a VTP domain configured.

Voice VLANs are Vlan 100 and Vlan 101 with networks 10.2.0.0/16 and 10.4.0.0/16 Voip telephones are communicating between them self and everything is working fine.I want to secure both voice VLANs with an ACL to allow only couple of IPs to administer the phones.The PCs are connected trough a integrated switch via VOIP telephone.Here is the sample configuration of the dhcp pool for the PC VLAN:

ip dhcp pool PCs
   network 10.1.0.0 255.255.0.0
   default-router 10.1.1.1
   dns-server 10.10.10.1
   option 43 hex 010a.5369.656d.656e.7300.0000.0204.0000.0064.0000.0000.00ff

I had to implement the 43 hex option because the PCs did not get the ip from the DHCP because of the vendor specific information.The thing that worries me is will the DHCP forward the ACKs for the PCs if I implement this test ACL:

ip access-list extended VLAN100
permit ip 10.2.0.0 0.0.255.255 10.4.0.0 0.0.255.255
permit ip 10.4.0.0 0.0.255.255 10.2.0.0 0.0.255.255
permit ip 192.168.2.0 0.0.0.255 10.2.0.0 0.0.255.255
permit ip 192.168.2.0 0.0.0.255 10.4.0.0 0.0.255.255
permit udp host 0.0.0.0 eq bootpc host 255.255.255.255 eq bootps  (this I am not sure do I need)
permit udp host 255.255.255.255 eq bootps host 0.0.0.0 eq bootpc   (also this)
deny   ip any any
 
I only want to allow the network 192.168.2.0/24 and maybe some other hosts to access the web based http gui to adiminister the IP phones.All PCs are connected trough the VOIP terminals. I do not want to deny the traffic to PCs.

View 8 Replies View Related

Cisco Firewall :: Access-List Traffic Control Attempting To Block RDP 3389

Nov 7, 2012

I have an ASA pair configured to replace a router that hosts a collection of IPSec Tunnels.  Tunnels appear to work.  I am lab'ing some additional controls that I would like to implement.  On the Production Router that i plan to replace with the ASA's the current Tunnels are all wide open (all traffic allowed to pass).  I was hoping to lock things down a little without having to reconfigure all of the Tunnels.  My though was that an ACL on the Inside Interface blocking selected traffic Out (so into the LAN) should not impact the stability of the Tunnels but allow me to restrict some traffic from entering the LAN.  One port that I was attempting to block is RDP 3389.  When this ACL is applied to the inside interface it does not block Port 3389 at all.  What am I missing?  Is it that the trffic is being allowed because it is coming through one of my 'open' Tunnels? 
 
Shouldn't IPSec Tunnel traffic be processed by the Inside Interface ACL just like all other traffic?
 
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 3389
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 135
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 137
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 138
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 139
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 445
access-list 145 deny   tcp 192.168.30.0 0.0.0.255 10.187.10.0 0.0.0.255 eq 389
access-list 145 permit ip any any
 
ip access-group 145 out interface Internal
 
This work great on a 2821 Router, but not so much on the ASA.

View 11 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved