| vschristopher 2002-10-07, 2:26 am |
| Hey buddy heres a small example to block telnet from a particular network.
Suppose there are 2 routers connected to each other via serial link.
Router A
E0/0 30.0.0.0
E0/0 40.0.0.0 sec
Router B
E0/0 50.0.0.0
E0/0 60.0.0.0 sec
now we need extended access list to deny telnet from network 30.0.0.0 to network 50.0.0.0
note that we use "outbound" for serial interfaces and "inbound" for ethernet interfaces.
the command we wil use is
#access-list 101 deny tcp 30.0.0.0 0.255.255.255 50.0.0.0 0.255.255.255 eq 23
#acess-list 101 permit ip any any
or you can write
#access-list 101 deny tcp 30.0.0.0 0.255.255.255 50.0.0.0 0.255.255.255 eq telnet
#acess-list 101 permit ip any any
now it shud be bind to an interface
#int s0/0
#ip access-group 101 out
voila ur access list is up and running now ... 
i hope u are familiar with the use of wild card masks in access lists.
0 in wild card masks mean to check
255 means dont check
i hope this works for u
chris |