Question on using route maps.

If you want to drop ALL packets that do not match ACL 110, then:

route-map FTPxSABINA permit 10 match ip address 110 match interface Loopback1

route-map FTPxSABINA deny 20

I thought there was an implicit deny at the end of the ACL 110.

Many thanks

Alex.

There is an implicit deny at then end of an ACL.

The nat statement would only do a translation if the route map found at match

Is that what is happening ?

What action to you want to take if there is not a match for translation ?

There is an implicit deny at then end of an ACL.

The nat statement would only do a translation if the route map found at match

Is that what is happening ?

What action to you want to take if there is not a match for translation ?

No, what you think doesn't happen. The ACL was written to limit the IP addresses that can reach the FTP server but I can see its prompt for username and pwd from the world. So the ACL doesn't do what it is expected to do (by me)

A discard of packets or better the packets mustn't be forwarded to the FTP server. I want to restrict IP addresses allowed to reach that FTP server.

I read that maybe when route-maps are used in conjunction with static NAT, the rule of translation only takes care of the destination and not both of source and destination

Go to

have a look to Benefits described for this features. They don't say that the NAT rule doesn't consider the source address but it seems to me that is what is happening to me.

Thanks, Alex.

Why are you doing this with a route-map instead of a packet filter?

You're correct but... I have already a big ACL on input on WAN interface where I implemented all security rules to avoid undesidered traffic from Internet. I hoped to manage this particular constraint directly specifying the service (I mean the static NAT).

Thanks Alex.