Cisco WAN :: 7200 VXR - Named Extended Access List

Oct 10, 2012

I've got a 7200 vxr that I'm trying to create a named extended access-list in.
I got to configure it if I go into ip after that the only commands available for access-list are log-update, logging, and re sequence.
so if I go back to the main config menu access-list is an available command
but then from the main config menu, if I type: access-list extended eth0_in it says invalid input detected at the carrot marker which is under the first character of the work extended.
also, at the main config menu, if I type: ip access-list extended eth0_in it again give me the invalid input detected at the word extended.
I don't understand what I am missing to get this to work.

View 9 Replies


Cisco Firewall :: ASA 5510 Version 8.2(4)2 Can't Remove ACL Named Extended

Feb 13, 2012

I have an access-list that was named "extended" (without quotation marks) and the ASA will not let me remove it.
I have tried everything I know to try and get it out, but I cannot remove a single line.
ASA(config)# no access-list extended line 1 extended permit ip host host<1> not a valid permission
ASA(config)# no access-list extended line 1 permit ip host host<1> not a valid permission

View 1 Replies View Related

Cisco Firewall :: Configure Extended Access List On AS5350XM?

Sep 14, 2011

I'm trying to configure an extended access list on one AS5350XM but I get one way hearing on a voice calls and I can't determine why (please see the attached diagram). There is an OSPF running on both gigabit interfaces and the Loopback address is also advertised (it is actually the voip IP address). The access list is applied on both interfaces in the inbound direction. There is another gateway with IP: (no firewalls here) and the routing between gateways is working properly.
Here is part of the access list (applied on AS5350):

permit ip host host
When I review the log of the AS5350xm I see many errors like this one:

%SEC-6-IPACCESSLOGP: list example denied udp ->, 1 packet
So how it is possible to see this error since the access list is in inbound direction and the IP address ( is open. I don't have problems when I do telnet or ssh from to

View 3 Replies View Related

Cisco Firewall :: 5540 - Extended Access-list Error Using FQDN

Nov 7, 2011

I'm trying to add an access-list rule to allow internal servers to connect an outside host on a asa 5540. The hostname translates to multiple ip's. Normally I just lookup the ip address or one of the ip's the hostname translates too and use that in the access-list as the host. For some reason the actual ip's, which are a few, are not always available so using a specific ip sometimes does not work, thus the reason I have to use the hostname instead of the ip. I have 2 hostnames. and
This is how I normally add these rules (the ip addresses are fictive): access-list internet_access extended permit tcp host host eq www log
When I try to add this using the hostname on our asa I get an error: access-list internet_access extended permit tcp host host  ?ERROR: % Unrecognized command
I've tried it without the 'www', so but same error.

View 4 Replies View Related

Cisco Switching/Routing :: 4503 -MAC Access-list Extended To Only Allow Gateway Traffic

Nov 7, 2011

We have a gateway on a 4503, say on port 2/1, and we only want the other devices that are plugged into the 4503 to be able to talk to the gateway and thats it.  The other devices are Motorola TUT DSL devices and they plug into the 4503 directly.
Normally "switchport protected" would make this very easy to keep stuff on one port from talking to other ports but with 4500's you are not able to do that command.  So we implemented a MAC Access-List Extended ACL.  Here is what we did
mac access-list extended BLAH
permit #host 0000.XXXX.YYYY any
interface range fa 2/5 - 20
mac access-group BLAH out 
The MAC address 0000.XXXX.YYYY is the MAC address of the gateway that is plugged into Fa2/1 and the DSL TUT devices are plugged into ports Fa2/5-20.  We would think that this config would only allow devices on the TUT DSL to talk only to the Gateway but we don't really think this is happening.  The TUT devices are learning about MAC addresses that are on other TUT devices. 

View 1 Replies View Related

Cisco WAN :: Access Control List On 7200 Router?

Dec 12, 2012

I am having some issues with creating an ACL for my gateway router.I want to block external access to my network from internet so i set up the ACL on the WAN port of my 7200 router asI am using named extened access list -

deny ip any log
permit ip any any
and i applied this inbound accesslist on the WAN port of router as
"ip access-group acl-in in"
Now i have blocked the external traffic to my network but the issue i am having is i am also unable to reach outside now. All i want is to block external traffic on the router WAN port but allow internal traffic to outside. Did i miss anything in the access list?

View 5 Replies View Related

Cisco AAA/Identity/Nac :: 7200 Default Network Access And CHAP

Feb 12, 2012

I am configuring some of my devices to use CHAP when their backup ISDN interface dials out to the 7200 concentrator node. I wan the CHAP requests to hit our ACS 5.2 appliances and be authenticated via this method. I have built a rule for 'Default netowrk access' which specifies these devices only however when I bring up the ISDN call the process fails. When I look at the logs it doesn't give an error reason but it does say that it failed on one of the rules in the 'default device admin' rule set.I even went to the bother of specifying a single IP address of one of the ISDN backup devices but the result is always the same.

View 3 Replies View Related

Cisco WAN :: ASR 1001- How Interfaces Are Named

Sep 3, 2012

I just need to start building the configuration of an ASR 1001 but I do not know how gigabitethernet interfaces are named on these routers? Are Gi0/0/X or Gi0/X ??

View 1 Replies View Related

Cisco :: Named Objects Or Object Groups In ASR 1000s?

Mar 5, 2012

Any way of doing named objects or object groups for ACLs on the ASRs? (1000 series in this case.) I'm setting up an ASR with a zone-based firewall and writing out all the addresses, ports and protocols for the ACLs associated with the various zones is creating huge, unwieldy ACLs in the config.

View 11 Replies View Related

Cisco WAN :: 1841 - Named Versus Numbered ACLs

Dec 27, 2010

In my test lab I am playing with the Numbered ACL's and Named ACL's. Both configurations are working BUT , I am sure I do something wrong in the Named ACL's version. When I reboot or reload the CISCO 1841 ROUTER , I do not have INTERNET anymore , I still have access by TELNET or SSH , but no external communication anymore. The only way to start the communication again , is by adding :

PERMIT IP ANY ANY . This will of course work , but the funny thing is that when I do a : NO PERMIT IP ANY ANY It still works !!!
I have learned by this to always shut down and restart my ROUTER or SWITCH to see if everything still work . Here bellow some parts of the working Numbered ACL's version :
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh port 8096 rotary 1
ip ssh version 2
[ code] ....

View 4 Replies View Related

Cisco WAN :: 1720 Router - Commands To Set Access List To Allow Access To Port 551

Nov 29, 2010

I am trying to allow telnet to port 551 but i couldn't get it to work.I am using a cisco 1720 router running on IOS 12.2.I am using the below commands to set the access list to allow access to port 551 using remote telnet to the Cisco router.hostname R1!interface ethernet0ip access-group 102 in!access-list 102 permit tcp any any eq 551.After i enter the above command the router will disconnect me and i will not be able to connect to it for awhile. Once the router is up i am still unable to telnet to port 551.

View 14 Replies View Related

Windows Can't Find Computer Or Named Device

Oct 12, 2012

I get 2 troubleshoot messages printer cannot be contaacyed over network and windows can't find a computer or device named....

View 1 Replies View Related

Linksys Wireless Router :: E1000 Is Showing Different Named Wifi Network?

Jun 29, 2012

I have a strange problem with my Linksys E1000. When I try to connect wireless, there is a network with an excellent signal, but it has the name "CiscoI1593" and it asks for a password which I don't know. My original network does not appear for some reason when I try to connect wirelessly. I do see my original network name when I use an ethernet cable through the E1000.
It's not possible, where I live, for this "CiscoI1593" network to belong to someone else, it just seemed like it renamed my network to this and also wants some different password. 
I think this may be due to something I did. My internet occasionally cuts out and it's usually something wrong with the modem or router, so I typically unplug and press the reset button on both until it begins to work again. This is the first time i've had this problem though, and I have unplugged and pressed the reset button on my router many times.
There is also a button in the middle of the front of the router that looks like a refresh symbol, but I don't really know what it is, pushing it doesn't seem to do anything but make a solidly-on light become blinky.

View 6 Replies View Related

Cisco WAN :: MAC Access-list In 881 And 892 Router

Dec 20, 2011

How to implement mac access-list in 881 and 892 router ? As you now that we can get additional switch-port in the same router but  I can't see the function in this router. I guess the switch port must function like the catalyst 2960 switch.

View 3 Replies View Related

Cisco WAN :: 3750 - How Big Can Access-list Be

Nov 20, 2011

I'm creating an access-list that will contain all networks and host that will be redistribute into EIGRP.Till now, this access-list contains 72 entries but this number can increase anytime.
I'm using a 3750-x layer 3 switch, and I'm wondering how big this access-list can be, regarding CPU and memory utilization and performance.

View 2 Replies View Related

Cisco WAN :: Access List In 861 Router

Jan 17, 2011

we installed a cisco router in a school with two vlans (VLAN 1 & VLAN 2) VLAN 1 is for teachers and Admin and VLAN 2 is for students. We want so that VLAN 2 shouldn't be able to access any device in VLAN 1 but VLAN 1 should be able to access all devices in VLAN 1 & 2


I am using VLAN interfaces. I know we have to use some access lists but if i apply

access-list 100 permit ip 0.0.255 any
access-list 100 deny ip
With this access list two subnets can not access each other. How these  access list should look likes ?

View 5 Replies View Related

Access-list Port 0?

Jul 25, 2011

I was reviewing some old configs at work today and noticed somthing weird in the access-lists. What is this?

View 6 Replies View Related

Cisco :: Creating An Access Control List?

Apr 6, 2013

Creating an Access Control List

View 2 Replies View Related

Cisco :: Access-list Does Not Exist In The Configuration?

Jan 12, 2012

so far i also knew that if u assign an access-list to an interface:

for example:
int vlan1
ip access-group 150 in

and the access-list does not exist in the configuration it will block everything meaning it will be an implicit deny empty access-list but lately i've noticed on new routers that its different,if i assign an acl to an interface where the acl doesnt exist in the configuration it acts as permit all,

View 3 Replies View Related

Cisco :: Can't Configure Access List According To Project?

Feb 27, 2011

this is a project and my configred file:I can't config access list according to the project.

View 19 Replies View Related

Cisco :: Access List In Vlan Interface

Jan 12, 2013

How to apply access list on Vlans ?

my Scenario is

13 Vlans in cisco 3560 switch (Vlan 10,20,30........ 130)

vlan 10 ---- ip range interface vlan 10 ip add :

vlan 20 ---- ip range interface vlan 20 ip add :

here i want to block vlan 10 access to vlan 20 i created extended access list deny ip

and applied in interface vlan 10 as out now i cant able to access any host in vlan 20 (host but i can able ping vlan 20's gateway

View 3 Replies View Related

Cisco Firewall :: Access-list On ASA5520

Feb 23, 2011

I have a question about access-lists on ASA: (5520 running 8.4)Often I want to permit all traffic from networks behind an interface (let's say DMZ in this example) to Internet, but NOT to internal networks. Then I  first configure a Deny from DMZ to all internal network and then a Permit to ANY. If I forget the first Deny I will allow all traffic also to my internal networks. Is it possible to configure an access-list that permit all traffic from a network to all networks that are reachable via a given interface? In this example: Permit all traffic from DMZ to all networks that are reachable via the Outside-interface? This should permit traffic to Internet and deny traffic to internal networks in one statement.If I specify the outside-interface as the destination only traffic to the interface itself will be allowed.

View 1 Replies View Related

Cisco WAN :: Access-list On Router 3945

Mar 15, 2012

I reported a really strange issue on a Cisco Router 3945. Here below info about release software used: [code] Please look at a brief extract of router running configuration file: [code] It’s an easy configuration of Extended ACL and the application on an Ethernet interface. The expected result is:

- The interface works properly (because access list is permitting every kind of data traffic in input)
- Checking “show access-list 180”, the counter of matched packets increments for all the packets that are forwarded inside the fa0/0/1.
But actually the Fastethernet 0/0/1 drops all the packets as if all the packets don’t match with access list (And this behavior is really incredible). The interface couldn't be used anymore because any kind of data traffic is denied.

View 14 Replies View Related

Cisco VPN :: Port-security Or Mac Access-list On 861 Or 881?

Nov 4, 2008

how to perform port security or mac access-list on LAN ports of router 861 or 881.There are commands access-list 700-799 , but I don't know how to apply that access list on configured vlan or particular port.

View 1 Replies View Related

Cisco WAN :: Router 2801 MAC Access List

Apr 9, 2013

I want to block access of some clients from the vlan1 to acces internet blocking their MAC address. How can i do this?
I have tring this way:
access-list 700 deny mac address 0000.0000.0000
access-list 700 permit 0000.0000.0000 ffff.ffff.ffff
int fa00
bridge-group 1 {input-address-list 700  output-address-list 700}
but it's not working .

View 1 Replies View Related

Cisco Firewall :: PIX 501 With 1 Static IP / NAT / PAT With Access List

Aug 24, 2011

I am having a problem getting this to work and I have always done it with 2 Static ip address.  but now this company changed to 1 and I am doing something wrong.

I have comcast with 1 static IP, I have a local LAN with 6 host and 1 server that does Mail and remote access and web traffic.

I need a config that allows me to use 1 static ip on the outside interface of the PIX and allow with an ACL 7 ports open to the server and allow all the local host out to the internet.

View 11 Replies View Related

Cisco :: Access List To Permit IP's Instead Denies All Traffic?

Feb 16, 2011

I'm new to this forum and Cisco in general but I feel it may be very resourceful to me as I am a new network administrator fresh out of school for a local credit unionHere's my situation:We need to limit access to one of our servers to only 3 workstations used by our IT department. The server is on a Cisco 3560G on port 17, which is the interface I'm trying to apply a standard, basic ACL to, which looks like this:

View 10 Replies View Related

Cisco :: Access Control List Practice Site?

Apr 25, 2013

I've been working on an application recently that practice ACL configuration, and since finishing I figured it should be put on the internet as there wasnt much more work to do to make it suitable for a website. It allows you to practice both standard and extended ACL configuration by generating a random number of ACL actions for you to configure, and provides the correct config to compare yours against to see if you were correct. It also emulates a router at a very basic level to allow practice when there is no equipment available.

View 9 Replies View Related

Cisco :: Access Control List Not Behaving As Expected

Dec 18, 2011

I have an extended acl on my VLAN interface in bound and it is working like I need it to, securing one side of my network from the other allowing only what I want from my desktops to my servers. The acls look something like this:

vlan70 -----> inbound acl (allows 80/443) ---> vlan100

I need vlan100 to have access to something on vlan70 now and I cannot get it to work. My question is would this work?

vlan70 -----> inbound acl (allows 80/443) ---> vlan100
vlan100 <----- outbound acl (allows 9100) <---- vlan70

Traffic is initiated from vlan100 not from vlan70 then back through so an established rule does not work. Also there are many more ports open in my inbound acl but this is simplified for ease of reading.I want to make sure if I place both an inbound and outbound rule on my vlan and that it is in the right place, both on the same vlan.

View 1 Replies View Related

Cisco :: Router Outside Firewall / Access List On Interface?

Apr 2, 2013

I have a router in front of a few firewalls on an internet link. All traffic from the inside network must go through one of the firewalls to get out through the router and similarly there is a dmz on one of the firewalls.I am trying to make sure the router is fully hardened.Should I apply an access list on the outside interface of the router along with the access list for management access?

View 11 Replies View Related

Cisco :: AS5400 SIP Gateway And Access-list Control?

Feb 3, 2011

I have a sip gateway (AS5400) that is used to connect sip providers to our internal voice network.Internal gateway ( LAN) -- SIP trunk -- AS5400 ( LAN/ WAN) -- SIP trunk -- Internet SIP Provider We encountered the following problem :A SIP call from internal gateway to the sip provider could establish but was muted on our side (sip provider could hear us)On the WAN interface of the AS5400, there is a ACL that filter traffic IN coming from SIP Provider

interface GigabitEthernet0/0
ip address
ip access-group 101 in

I log the deny on this ACL and I saw some udp packets denied with LAN addresses !*Mar 3 15:24:44.001: %SEC-6-IPACCESSLOGP: list 101 denied udp -> (0), 1 packet I did not bind anything on the sip config.When I changed the ACLs, calls went well.Why do I see LAN packets on the WAN interface ?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: User Restriction With Access-list In ACS 5.2

Jun 11, 2011

I am trying to create a user restriction to allow one user to access only two networks ( and I have range of networks but I want to permit only two networks for limited user and full access for the admins. I know this was possible with ACS 3.3 but I am not too sure if this is also applicable with ACS 5.2.

View 1 Replies View Related

Cisco WAN :: 6509 / Classify IS-IS Traffic With Access List?

May 16, 2012

I'm configuring Control Plane Police in a Catalyst 6509. This equipment is using IS-IS like its IGP routing protocol, and iBGP. In order to make CoPP work Im classifying the traffic entering the control plane like CRITICAL, IMPORTANT, NORMAL, UNDESIRABLE and DEFAULT. Obviously routing protocol traffic must be classified like CRITICAL. Doing so is easy to BGP because it runs over TCP/IP and I can configure the following access list to classify BGP:
ip access-list extended CP-CRITICAL-IN
remark #### ROUTING TRAFFIC - BGP ####
permit tcp host [BGP neighbor addr] eq bgp host [local BGP addr]
permit tcp host [BGP neighbor addr] host [local BGP addr] eq bgp
deny   ip any any
But IS-IS is also a CRITICAL traffic,  but IS-IS doesn't run over TCP/IP, rather it exchange its own PDUs. So, how do I classify IS-IS traffic with an access list?

View 3 Replies View Related

Copyrights 2005-15, All rights reserved