ACL Nightmare

[Khan2Tin]

Help! What is wrong with this ACL? I basically want to block all telnet access to host 192.168.0.1 except for 192.168.10.2

access-list 102 permit tcp any any established
access-list 102 deny tcp any host 192.168.0.1 eq telnet log
access-list 102 permit tcp host 192.168.10.2 host 192.168.0.1 eq telnet
access-list 102 permit ip any any

!
interface FastEthernet0/0
ip address 192.168.0.3 255.255.255.0
ip access-group 102 out

Thanks!

 

[webnetwiz]

Your deny statement is processed and applied before you're allowing telnet acces from host 192.168.10.2. Put your permit statements before your deny statements.

 

[Khan2Tin]

Tried this, didn't work I can still telnet host 192.168.0.1 from any other host.

access-list 102 permit tcp any any established
access-list 102 permit tcp host 192.168.10.2 host 192.168.0.1 eq telnet
access-list 102 deny tcp any host 192.168.0.1 eq telnet log
access-list 102 permit ip any any

 

[webnetwiz]

I assume you've rebooted the router after changing the ACLs?

 

[Khan2Tin]

I don't think router requires a reboot after you applied ACLs.

 

[rcasta]

In deed no reboots are needed when changing or aplying ACL's

try denying host 0.1 as 1st statement.

access-list 102 deny tcp any host 192.168.0.1 eq telnet log
access-list 102 permit tcp any any established
access-list 102 permit tcp host 192.168.10.2 host 192.168.0.1 eq telnet
access-list 102 permit ip any any

hope it helps,

 

[Khan2Tin]

Hi rcasta, thanks. That didn't work

damn ACL, lol

 

[webnetwiz]

in 99% of the cases u don't have to reboot, however, I've had a case where a Cisco PIX firewall would not take an ACL until it was rebooted (or ACL had to be re-applied almost 400 times)

 

[BasicITOne]

Hey people did everyone forget the first rule of ACL Each line is processed and if a match is made then the following lines are not processed.
The first line is basically allowing all tcp traffic no other line will be checked. And remember the implicit deny all at the end.

access-list 102 permit tcp host 192.168.10.2 host 192.168.0.1 eq telnet
access-list 102 deny any host 192.168.0.1 eq telnet
access-list 102 permit tcp any any established
access-list 102 deny any any