am practising access lists

and am haveing no joy

trying to prevent a pc 192.168.1.101 telneting to a router 192.168.1.200

using extended access list 110
deny any host 192.168.1.101 eq 23

and it can still connect

any 1 any ideas where i am going wrong cheers for any help

Report this post to a moderator

Have a look at your access-list and the following doc.
http://makeashorterlink.com/?V2B544C99

The key is the location of source and destination within the command, and using the information given to you in the question - get used to using the command reference.

Report this post to a moderator

[to a router 192.168.1.200

using extended access list 110
deny any host 192.168.1.101 eq 23

and it can still connect

any 1 any ideas where i am going wrong cheers for any help [/B][/QUOTE]

* check the syntax
* apply to ethernet port router(config-if)access-group in
* (config)#access-list 101 tcp deny any host 192.168.1.101 eq 23
this might solve ur problem

Report this post to a moderator

Take Mat's advice.

The extended ACL will use the syntax

access-list list_number permit/deny source destination other_options

If you're wanting to prevent connections from the source 192.168.1.101 (the PC) from accessing the destination 192.168.1.200 (the router) via telnet, you would use

access-list 101 deny tcp host 192.168.1.101 host 192.168.1.200 eq telnet

or

access-list 101 deny tcp 192.168.1.101 0.0.0.0. 192.168.1.200 0.0.0.0. eq 23

or any variation of the two.

You don't want to specify "any" as the source in the ACL unless your intention is to deny telnet traffic from all hosts rather than from just that specific source (the pc).

You'd then apply the access list to the interfaces for inbound traffic.

It'd be better if you'd just create a standard access-list and apply it directly to the VTY lines though. Good luck with your studies.

na_venkatesh2, like the origional poster, you have your source as any and the destination as the PC.

__________________
.:|:.:|:.

Last edited by smrkdown on 10-31-04 at 08:10 PM

Report this post to a moderator

smark , ur access-list requires a small modification .
when host is represented, the wild card will be 0.0.0.0

access-list 101 deny 192.168.1.101 255.255.255.255 192.168.1.200 255.255.255.255 eq 23

access-list 101 deny 192.168.1.101 0.0.0.0 192.168.1.200 0.0.0.0 eq 23
Ful configuration
router#config t
router (Config)# access-list 101 deny 192.168.1.101 0.0.0.0 192.168.1.200 0.0.0.0 eq 23
router(config)# interface fa0/1
router(config-if)#ip access-group 101 in

if u want to apply for vty line
router(config)#line vty 0 4
router(config-line)#access-class 101 in

good luck

Report this post to a moderator

My mistake.

__________________
.:|:.:|:.

Report this post to a moderator

cheers for all the help

Report this post to a moderator

Better put in "deny TCP etc". etc if you want to pass ccna.....
r

Report this post to a moderator

You'll also want to put at least one permit statement at the end of the list such as "access-list 101 permit ip any any"

__________________
.:|:.:|:.

Report this post to a moderator

So right, unless you want to block all traffic
r

Report this post to a moderator