Catalyst ACL Question
 

I am trying to setup a Catalyst 3550 and previously have only limited experience with a PIX. What I have done is set up 2 VLANs 1 for our internal network stuff and 1 for our internet facing stuff. On the internet facing stuff I want to limit access to our external web server and only allow a select list of ports in but allow everything outgoing. I thought I could do this using an extended ACL such as this

ip access-list extended Webserver
permit tcp any eq www any
permit tcp any eq 443 any
permit tcp any eq ftp-data any
permit tcp any eq ftp any
permit tcp any eq 3389 any
permit tcp any eq domain any
deny ip any any

However when I apply this the computer doesn’t seem to be able to see anything on the outside, the inbound filtering does seem to work though.

If anyone has any recommendations I would really appreciate it.

Colin Fischer

Re: Catalyst ACL Question
 

"newb" <newb@newb.com> wrote in message
news:Yz_4d.492815$M95.251050@pd7tw1no...
> I am trying to setup a Catalyst 3550 and previously have only limited
experience with a PIX. What I have done is set up 2 VLANs 1 for our internal
network stuff and 1 for our internet facing stuff. On the internet facing
stuff I want to limit access to our external web server and only allow a
select list of ports in but allow everything outgoing. I thought I could do
this using an extended ACL such as this
>
> ip access-list extended Webserver
> permit tcp any eq www any
> permit tcp any eq 443 any
> permit tcp any eq ftp-data any
> permit tcp any eq ftp any
> permit tcp any eq 3389 any
> permit tcp any eq domain any
> deny ip any any
>
> However when I apply this the computer doesn't seem to be able to see
anything on the outside, the inbound filtering does seem to work though.
>
> If anyone has any recommendations I would really appreciate it.
>
> Colin Fischer

Colin,

You are using source ports instead of destination ports. Your acl should be
like this:

ip access-list extended Webserver
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq ftp-data
permit tcp any any eq ftp
permit tcp any any eq 3389
permit tcp any anyeq domain
deny ip any any

Source ports are random.

Hope that helps,

Jim