Access List to allow FTP and Ping

[bjh60]

I am looking to define an access list to do the following

Allow FTP traffic from one network to another
Allow ICMP Ping from one network to another
Allow NOTHING ELSE.

Networks are 172.28.1.0 255.255.255.0 and
172.28.2.0 255.255.255.0

I keep trying different things, but end up locking myself up.
Any help would be appreciated.

Thanks

 

[mrkool]

access-list 101 permit tcp 172.28.1.0 0.0.0.255 172.28.2.0 0.0.0.255 eq 20
access-list 101 permit tcp 172.28.1.0 0.0.0.255 172.28.2.0 0.0.0.255 eq 21
access-list 101 permit icmp 172.28.1.0 0.0.0.255 172.28.2.0 0.0.0.255 echo

The rest of the traffic will be denied coz router automatically discard unmatched traffic.

 

[bjh60]

Where would I apply this access-list - and would it be out or in?

Thanks

 

[Whoheard]

What side of the router are you on? Are you consoled into the router or VTY?

If you are VTY, you can't just add those access-lists and expect it to allow you access to the router. By applying those to the interfaces, you have locked yourself out of the system--you are not on the access-list. Add another access-list and apply it to your VTY connections:

access-list 103 permit ip <your pc ip> 0.0.0.0 any

I would apply the follwing &quot;inbound&quot; access-lists to the applicable interfaces this way:

172.28.1.x inteface
access-list 101 permit tcp 172.28.1.0 0.0.0.255 172.28.2.0 0.0.0.255 eq 20
access-list 101 permit tcp 172.28.1.0 0.0.0.255 172.28.2.0 0.0.0.255 eq 21
access-list 101 permit icmp 172.28.1.0 0.0.0.255 172.28.2.0 0.0.0.255 echo

172.28.2.x interface
access-list 102 permit tcp 172.28.2.0 0.0.0.255 172.28.1.0 0.0.0.255 eq 20
access-list 102 permit tcp 172.28.2.0 0.0.0.255 172.28.1.0 0.0.0.255 eq 21
access-list 102 permit icmp 172.28.2.0 0.0.0.255 172.28.1.0 0.0.0.255 echo



bob

 

[CaMedic]

Remember allowing port 20 and 21 will allow PASSIVE ftp only. not active FTP...

Here is why.

Passive,
client >1023 to 21 Server
Client >1023 to 21 server

Active
client >1023 to 21 Server
server 21 to >1023 client

in active the server actually establishes the return connection.

This is all from memory, so i may be a little off...

 

[Whoheard]

I would check these two sources before deciding what to do about that. There seems to be some questions about the security of that type of statement in a filter list.

Since they are both private networks, access-lists 101 and 102 should cover your needs just fine. if not, just add &quot;EST&quot; to the end of the access-list statement lines, i.e. access-list 102 permit tcp 172.28.2.0 0.0.0.255 172.28.1.0 0.0.0.255 eq 20 est



Source 1

http://www.phate.net/docs/security/cisco-acl-thoughts.txt

Source 2

http://www.sans.org/rr/firewall/reflex.php

Let me know what happens.

bob