ACL on router:SMTP server to be tested.

[krsnavan]

I want to allow SMTP,FTP,TELNET,143.icmp only from both netwrok.

And i want reply from SMTP server. if i give command "telnet 10.135.1.10 25 'to check the server otherside of the network is working.

chek the config is correct!i m able to ping both sides.but when i do "telnet 10.135.1.10 25 'to smtp server, i can not get any reply.


interface Ethernet0

ip address 10.125.0.3 255.255.240.0

access-group 101 in



!

interface Ethernet1

ip address 10.135.1.1 255.255.255.0

duplex auto

access-group 102 in


access-list 101 permit icmp 10.125.0.0 0.0.15.255 any

access-list 101 permit tcp 10.125.0.0 0.0.15.255 10.135.1.0 0.0.0.255 eq smtp

access-list 101 permit tcp 10.125.0.0 0.0.15.255 10.135.1.0 0.0.0.255 eq ftp

access-list 101 permit tcp 10.125.0.0 0.0.15.255 10.135.1.0 0.0.0.255 eq www

access-list 101 permit tcp 10.125.0.0 0.0.15.255 10.135.1.0 0.0.0.255 eq 143

access-list 101 permit tcp any any eq telnet

access-list 102 permit icmp 10.135.1.0 0.0.0.255 any

access-list 102 permit tcp 10.135.1.0 0.0.0.255 10.125.0.0 0.0.15.255 eq smtp

access-list 102 permit tcp 10.135.1.0 0.0.0.255 10.125.0.0 0.0.15.255 eq ftp

access-list 102 permit tcp 10.135.1.0 0.0.0.255 10.125.0.0 0.0.15.255 eq www

access-list 102 permit tcp 10.135.1.0 0.0.0.255 10.125.0.0 0.0.15.255 eq 143

access-list 102 permit tcp any any eq telnet



Vanna

 

[Alterac]

You need to allow established connections also.

access-list 101 permit tcp any any established

and

access-list 102 permit tcp any any established


----------------------------------
Bill

 

[krsnavan]

Bill!

U r great!

I had doubt in mind whether i need to add "established" in ACL.If apply the following "access-list 101 permit tcp 10.125.0.0 0.0.15.255 any eq telnet established", will it allow the return packets when i telnet from 10.125.0.0 network?

Whether i have to add "Established" to allow SMTP,FTP,

http://WWW,143

traffic.

Explain me how the "established" to be added plz.

thanx.

 

[burtsbees]

Adding the established keyword means that the acl will only allow those connections that have been established by the router already, which lets return traffic back in. Basically, it looks for the SYN bit to be set in the TCP segment.

Burt

 

[krsnavan]

This avoids the need of specifying the rules for the Outward direction!Is it correct!i already done the rules and it works fine.

Thanx U for all the help!Great work!