Allow POP3 access only 1

[CatPlus]

Hello!

Here are the entries on my CISCO PIX to allow user's within 192.168.111.201 through 192.168.111.254 access their e-mails via Outlook on our POP3 account. All other internet browsing is denied to users within this NAT range (.201 to .254)

Is there not a way to group all those IP addresses so I do not have to add as many lines as Lines 4, 5, 6, 7 and 8 etc. below?

Thanks for your help!

Mickey

[Line 1] access-list in_e1 permit tcp any any eq smtp
[Line 2] access-list in_e1 permit tcp any any eq pop3
[Line 3] access-list in_e1 permit udp any any eq domain
[Line 4] access-list in_e1 deny ip host 192.168.111.201 any
[Line 5] access-list in_e1 deny ip host 192.168.111.202 any
[Line 6] access-list in_e1 deny ip host 192.168.111.203 any
[Line 7] access-list in_e1 deny ip host 192.168.111.204 any
[Line 8] access-list in_e1 deny ip host 192.168.111.205 any

 

[lgarner]

use a network-object in your configuration

 

[CatPlus]

Hi Igarner

Thanks for your reply. I am new to CISCO and would very much appreciate if you could give me some more details.

BTW, would changing below encap the entire range?

FROM:access-list in_e1 deny ip host 192.168.111.201 any
TO :access-list in_e1 deny ip host 192.168.111.2?? any

Thanks for your help!

Mickey

 

[lgarner]

http://www.cisco.com/en/US/products..._guide_chapter09186a00800eb721.html#wp1024374

If you mean to literally put in question marks, no. You can use subnet ranges or hosts addresses:

.. deny ip 192.168.111.192 255.255.255.192... would be close in your case and would deny all hosts from 192.168.111.192 through 192.168.111.254, inclusive.

Object groups are probably a better way to go. You apply the ACL to a group of network-objects, protocols or icmp-types so you don't have to do each one individually. The definitions can mixed subnets and hosts.

Your ACL would then be something like:
access-list in_e1 deny ip object-group restricted-hosts any

and the you'd define the restricted-hosts object group with the hosts from which you want to block all IP traffic.

 

[CatPlus]

Thanks indeed Igarner

Mickey