quick ACL question

[jdeane]

I am trying to split a subnet in two and prevent the upper half from having telnet access to the outside world.

The ip subnet is 171.17.0.64 - 171.17.0.127 255.255.255.192

I wish to allow 171.17.0.64 - 171.17.0.95 telnet access and
disallow 171.17.0.96 - 171.17.0.126

I'm I right in using
access-list 111 deny tcp 171.17.0.96 0.0.0.31 any eq telnet

Thanks

Jon

 

[mikadog]

access-lists have an implicit deny any at the end of them. You are going to have to have at least one permit statement in the access-list. Try this:

access-list 101 permit tcp 171.17.0.64 0.0.0.31 any eq telnet

hopefully this will get you headed in the right direction...because of the implicit deny any the other subnet would be blocked..

also don't forget to apply this to an interface with the access-group command...

mika