Cisco ADSL router and access control lists :--(

quackers · 17 Feb 2007 at 16:12

hi all,

I'm wondering if someone can give me a bit of a hand, i'm having difficulty setting up a cisco 107 adsl router with some control lists.

Now my boss had a go of setting this up about a year ago and then gave up, so now it's my turn :eek:

Has anyone had any experience of setting this type of router up, i'm working my way through the CCNA at the moment but this isnt covered.

Firstly we want a control list to just permit all the traffic, just so we can get it working.

Access-list 1 permit any any

Would that be enough? As you can tell acl's scramble my brain!

bitslice · 17 Feb 2007 at 18:17

I can't answer the question, but wouldn't the Security Device Manager (SDM)
be a good starting point ?

http://www.cisco.com/en/US/products/ps6216/products_data_sheet0900aecd8028a9ee.html

.

Tui · 17 Feb 2007 at 21:43

If you want to define source and destination (and ports) you need an extended list which uses numbers 100 - 199, so you would do something like:
access-list 101 permit ip any any

For simple ACL stuff, look at:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml

quackers · 17 Feb 2007 at 23:40

I've tried sdm, when it loads the final page i get a load of java script. So i'm not sure what's going on, i've got the latest java, tried firefox and ie7

Rich · 18 Feb 2007 at 22:12

Internet Explorer:

Tools>Internet Options>Advanced> Tick the "Allow Active content to run in files on my computer".

This should fix the issues you are having with SDM.

NiCkNaMe · 18 Feb 2007 at 22:52

You not only need to declare the ACL, as you've done but you also need to apply it to an interface, in a direction. (In or out)

Command for that is; (in global config mode)

Router(config)#interface <whatever interface)
Router(config-if)#ip access-group <ACL NO> <IN|OUT>

As has been said, 1-99 = Standard ACL (only good for denying traffic to certain areas really) then you've got your extended ACL's (100+) where you can specify ports, etc.

Do some reading here;

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

Good thing to remember as well is that majority of cisco ios's contain an implicit deny any at the end, so everything will get denyed once you apply one, so unless your ONLY allowing what YOU want, then a permit any any would be a good starting point!