Hi I'd like to deny access to a host on the intranet to all but one IP address. I can't think of a better solution than as follows:
access-list incoming deny tcp any host 209.178.198.249 access-list incoming permit tcp 216.239.35.101 host 209.178.198.249
But it doesn't seem to work. Your help is appreciated. Thanks & Regards
What does "it doesn't seem to work" mean? Does everyone connect to it? Does none connect to it?
Where have u applied that ACL? Are they the only statements the ACL has?
Too few informations Alex.
Your second line won't match any traffic as any connections from
216.239.35.101 to 209.178.198.249 will be blocked by the first line ('any' does include 216.239.35.101 ;-)).Also, if you are trying to block all TCP and UDP traffic then use 'block/permit ip') or if you intend to block/permit a TCP port then you need to state the port number.
access-list incoming permit tcp 216.239.35.101 host 209.178.198.249 eq access-list incoming deny tcp any host 209.178.198.249 eq or access-list incoming deny ip any host 209.178.198.249
Chris.
Hi,
Please move the seconds line above the first. The acl's are applied top-down so you need to permit a specific host before you deny everything else. The match process stops as soon as a line in the acl matches. Secondly, access-lists that filter traffic on tcp most likely "need" to have either source or destination port specified. If you do not specify any ports, you'd probably want to deny all traffic an not only tcp. Is this the case, then change "tcp" to "ip" .
Regards, Erik
Have something to add? Share your thoughts — no account required.
Ask the community — no account required