ACL and routing

[hectormz]

Hi all,

In one of our routers 192.168.X.X (a 1700 with IOS 12.0(7)T)that's connecting in one serial subinterface with another cisco 10.40.X.X(a 2600 with IOS 12.0(2)XD1) i recently add the following ACL:

access-list deny tcp any any eq 69
access-list deny udp any any eq 69
access-list deny tcp any any eq 3127
access-list deny tcp any any eq 3198
access-list permit ip any any

The idea was to block Blaster's propagation (port 69) and MyDoom's trojan listening; but from my 1700 i could'n see the 2600, in the sh frame pvc everything seemed OK, but the people on the other side we unable to connect to one of out servers. Removing the recently added ACL was the solution...i don't know why this happened, any ideas?

Regards,

 

[labsonline]

If your users are trying to tftp somewhere, this ACL blocks it. If they are using some other app that targets 3198 and 3127, this blocks it as well. Find out from your users what apps they are using and ports they are targetting along with the destiantion IP and allow this connectivity. Block everything else going to those ports.

HTH,
Robert

 

[hectormz]

Thanks for the reply,

The app they're using is Mapics/AS400, and as far as i know the connect using port 23. Even if there was another app using the ports we blocked the fact that there was no response from router to router is what draws my attention, Do the routers communicate between the using port 69, 3127 or 3198? I didn't think so, but no i have a doubt

The 2600 router connects with a DS0 line and the 1700 is in a Frame-Relay link.

Thanks again for the reply,
Regards
-Hector

 

[labsonline]

Can you post your configs? Also let me know which router the users reside on.

robert

 

[Syty]

You have have had a problem with the application of the access-list.

I'm not sure what seeing your configuration will do at this point. can you see the other router without the access-list?

One more thing, your stopping 3127 and 3198, won't do you much good, as the Novarg Virus uses 3127 THROUGH 3198

Shutting down all of those port in between may not be feasable, update all of the virus software def files and re-approach the router from an existing traffic perspective, versus attempting to block traffic coming into your network.....

 

[hectormz]

Yes, i can see the other router without the ACL.

The users are on the 2600 router 10.40.x.x with the DS0 link.

Thanks for the correction Syty, our antivirus are updated, there's no problem over there.

I'm trying to block those ports cause in the side of the router 2600 there are some of our workstations used by another enterprise, without AV cause they're old equipment. We don't know the exact use they give to those machines, and I don't want them to be an open door to our network.

I'm trying to block all unnecesarie ports to reduce the risk of future attacks.

Regards,
-Hector