ACL help please

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

Threaded View
Heloo- can anyone tell me what diffrence it makes using
access-list 101 permit tcp
or
access-list 101 permit ip
TIA
I asked my tutor who said it makes no diffrence?


Re: ACL help please
Quoted text here. Click to load it

"access-list 101 permit tcp " won't permit udp

"access-list 101 permit ip" permits both tcp and udp services

Aubrey



Re: ACL help please
ok thanks-could you clarify that "permit tcp" wont allow tftp,simple
network managment and dns?whereas ip would? many thanks
Aubrey Adams wrote:
Quoted text here. Click to load it


Re: ACL help please

Quoted text here. Click to load it

Look at what protocols each of those applications use.  Do they use 'tcp' or
'udp?  With DNS are you interested in 'queries' (which use udp) or zone
transfers (which use tcp)?  Though Windows will also use tcp for queries if
it has many to send.

BernieM



Re: ACL help please
Good information

We buy sell all Cisco, Discount up to 80% off on New Used Cisco.
LinkWaves Corp
29980 Technology Drive, Suite 6
Murrieta, CA 92563
http://www.linkwaves.com/requestquote.asp
http://www.linkwaves.com /
909-725-9143



BernieM wrote:
Quoted text here. Click to load it


Re: ACL help please
On Sat, 19 Aug 2006 00:09:51 -0700, gregg johnstone wrote:

Quoted text here. Click to load it

Wow, your tutor says, it makes no difference? very bad tutor...

Remember the OSI model?

layer5    BGP
layer4    TCP, UDP
layer3    IP, OSPF
layer2    ethernet, Frame_relay, etc
layer1    physics

If you say "permit IP", you permit any layer 'above and including the IP
layer'. So, that would mean you permit any IP protocol (TCP, UDP, ESP, AH,
etc)

If you say "permit TCP", you permit any layer 'above and including the TCP
layer'. So, that would mean you permit: any TCP protocol (BGP, telnet,
HTTP, etc). But you will not permit UDP, ESP, DOMAIN, TFTP, etc)


In short IP includes TCP, TCP does not include IP.

FW


Re: ACL help please

Quoted text here. Click to load it

OSPF sits on top of IP - protocol nr 89.

Quoted text here. Click to load it



Re: ACL help please
On Sat, 19 Aug 2006 20:27:13 -0500, John Agosta wrote:

Quoted text here. Click to load it

Yes, I typed too quickly. I know that.
I tried to make clear that there is a difference between permit ip
and permit tcp.

FW



Re: ACL help please

Quoted text here. Click to load it

Another lousy tutor that makes me feel so sorry for his students.

Here is an example, so you can tell the difference:

Gobal mode:
access-l 101 deny tcp any "ip address" eq 25
access-l 101 permit ip any any

Interface:
ip access-group 101 in (out)

Notice that 25 is a TCP port

The Dude







Re: ACL help please

The Dude wrote:
Quoted text here. Click to load it

Thanks guys- I have a little more Ledge now.


Re: ACL help please
gregg johnstone wrote:

Quoted text here. Click to load it


He is badly wrong. The first will only permit tcp, the second will permit UDP
and ICMP as well.
--
Paul Matthews                                         CCIE #4063
Please post questions to the NG, NOT by e-mail.

Re: ACL help please
Thanks for that -clarification is essential

btw can you tell me why the TCP/IP protocol stack matches layers 3-7 of
the OSI model-I saw the question on a practice exam.
TIA
Paul Matthews wrote:
Quoted text here. Click to load it


Re: ACL help please

Quoted text here. Click to load it



TCP/IP model has 4 layers:

Application
Host-to-Host
Internet
Network Access



OSI Model has 7 layers:

Application
Presentation
Session
Transport
Network
Data Link (which has 2 sublayers: LLC and MAC)
Physical


The Dude



Re: ACL help please
TCP/IP                             _   OSI           _
                                       |   Application   |
Application---------------------  |  Presentation  | ------  Handled by
the application/software
                                       |_ Session      _|
Transport------------------------ -> Transport
Internetwork ------------------ ->_  Network  _
Network Interface --------------|    Data Link | ----------  Handled by
the NIC (network interface
                                        |_  Physical _|
card)

Hope that helps

The Dude wrote:
Quoted text here. Click to load it


Re: ACL help please
gregg johnstone wrote:
Quoted text here. Click to load it

There's no reason.  TCP/IP predates ISO's OSI model quite a bit.  OSI
model was a just a twinkle in someone's eyes when TCP/IP was up and
running.

OSI is DEAD DEAD DEAD DEAD.  It's completely dead model and is only
useful for passing idiotic tests that insists on testing dead
technology that is of no use.

So just memorize the OSI model and move on.  Dump the knowledge after
you take the test.  DOD Model (tcp/ip) is more than adequate for
troubleshooting, thinking logically etc.

--

hsb


"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************

Re: ACL help please

Hansang Bae wrote:
Quoted text here. Click to load it

So is it just a Cisco question? I am sure I read another test where it
said it matched diffrent layers ? Fair enough ,thanks for the heads
up./.


Re: ACL help please
gregg johnstone wrote:
Quoted text here. Click to load it

Everyone uses it.  I had it show up on every test I ever took (Novell,
MS, CNX, Sniffer, CCNx/IE etc.etc...ad nauseum)

Really quite annoying...to tell you the truth! :)

--

hsb


"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************

Re: ACL help please

Holleran.Kevin@gmail.com wrote:
Quoted text here. Click to load it

Thanks for that guys,but I still dont undrstand why it matches layers
3-7-can you dumb it down a little please?


Site Timeline