ACL - destination port

[SmallRoad]

I am trying to block SNMP and SNMP Trap comming into my network from a connected site, but the traffic comes in on what appears to be changing port numbers although the destination ports 161 and 162 are the same. Can I write an access list based on the destination port of a packet when the source port is variable?

I have tried, access-list 103 deny tcp any any range 161 162
but this seems to be looking for source port, I want to say any any ANY range 161 162

Thanks,
Alastair

 

[oj88]

"access-list 103 deny tcp any any range 161 162" should work.

This access-list says that you are denying any source IP address going to any destination IP address with a destination TCP port range of 161 to 162. Orlando Palomar Jr
CCIE# 11206, CCNP
CIPT Operations Specialist
Phil-Data Business Systems, Inc.