Filter ports on my 3600?

[ianbla]

Is it possible to filter the ports on my 3600, I use it as a gateway router and want to tie it down a bit.

We had a recent infection with the SQL Slammer and I want to check that it it happened again we couldn't infect one of our customers.

 

[baddos]

access-list 101 description Deny SQL Slammer
access-list 101 deny tcp any any eq 1434
access-list 101 permit ip any any
interface fastethernet0/0
ip access-group 101 in

 

[ianbla]

Mmmmmm.

I have put the following on my 3640

interface fastethernet0/0
ip access-group 171 in


access list 171 deny udp any any eq 1434 log (1 match)
access list 171 permit ip any any (136811 matches)

I then took a look at my SYSLOG server to see who was trying to send this packet, it wasn't logged although there were plenty of entries for the 3640, there was no entry for this event.

My logging is;

Trap logging: level informational, 24647 message lines logged
Logging to 192.168.10.87, 17316 message lines logged

Any idea why this wouldn't be logged?

 

[rcasta]

Have you set a sniffer to see what's going on thru the FE interface?

 

[baddos]

Change this

access-list 101 deny tcp any any eq 1434

to this

access-list 101 deny tcp any any eq 1434 log

-Bad Dos

 

[ianbla]

That's what I have