ACL question - help im newbie

[neil72]

i am still learning acl's and im trying to understand how to write out an ACL containing the following rule:-

i have been given a network address 201.0.0.0/24 for a server pool outside of my LAN. the server pool addresses are divided in half. the servers in the upper half of the address range are reachable only by my management hostson my LAN using all IP protocols. the servers in the upper half are not to be accessed by the production hosts from my LAN using all IP protocols.the servers on the lower half of the address range are reachable by all of hosts from my LAN using all possible IP protocols.the servers should not be accessible by any other hosts.

Do i have to work out the IP range for the server pool? as i have not been given this. Then write the ACL rule onto my router.

Any examples on how to do this would greatful as im struggling alittle with these - the penny has not droped yet :O(

 

[reliancetech]

Wildcard Mask ( Also called as Inverse Mask) is the solution.

Define your service, If your service is http (80)

#access-list 101 permit tcp 201.0.0.0 0.0.0.255 any eq 80

This will allow whole 201.0.0.X network ( All 254 IPs) to access http services.


#access-list 101 permit tcp 201.0.0.0 0.0.0.128 any eq 80

This will allow only 1st subnet of 128 that is 201.0.0.1 to 201.0.0.127 use the services.

Regards,

Nayan

 

[neil72]

Hi Nayan,

Thanks for the info....that makes complete sense to me now.

Appreciate your help!

Neil.

 

[neil72]

Nayan,

If i wanted all services in the server pool could i change the 'eq 80' to 'any'?

thnaks.

 

[GeneralDzur]

yes - you could do that

 

[neil72]

how do i define a range of ip addresses,leaving my LAN, that can access the top range of the servers in the server pool. do i need to put in a range of source addresses in an extended ACL?

 

[reliancetech]

Remember rule 1 of ACL "There is alawys a deny all at the end of each ACL" So define pool for your top renge servers to acceess its services and deny everyone else.

Thus you will have renge of user connecting o server and others can not access.