i do not understand example

Sep 11, 2006 4 Replies
V
i do not understand example open original image

hell,



in pix 6.0 configutarion guide i found this:



" In the next example, dmz1 interface users are restricted from web browsing on other interfaces, but one host at 192.168.1.2 has web access. Put the port you want to restrict users from after the destination address. The following example shows these commands: access-list acl_dmz1 deny tcp any any eq www access-list acl_dmz1 deny tcp host 192.168.1.2 any eq www access-group acl_dmz1 in interface dmz1 "



i do not understand why in second access-list is 'deny' if the discription tells that user from 192.168.1.2 has web access? i thought that there shuld be 'permit'!



Vote
Twitter Facebook LinkedIn
W

You are right, and also the order should be reversed:

access-list acl_dmz1 permit tcp host 192.168.1.2 any eq www access-list acl_dmz1 deny tcp any any eq www access-group acl_dmz1 in interface dmz1

except that you should likely also permit outgoing dns queries.

Vote
Twitter Facebook LinkedIn
V

this error is in 'Step 14-Add Outbound Access Lists' second example in 'Restricting Users from Starting Connections' in guide at cisco site!

formatting link
they should fix it. for begginers it is more confusing!

Walter Roberson napisal(a):

Vote
Twitter Facebook LinkedIn
J

Yes it's completly wrong - you can tell Cisco by filling out the Feedback Form at the bottom of the page. I did this recently and they mailed me back a few weeks later to say that they had corrected the document.

James

voytas wrote:

formatting link

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required