BAH! Stupid access lists.....

[=ACID RAIN=]

First, my grade does NOT depend on this item. While it is classwork, it does not reflect on my final grade (or any grade). This is something I just have to figure out because it's ****ing me off LOL

First, the requirements:
Implement the following ACL rules using ACL number 101:
1. Allow hosts on the 192.168.30.0/24 network web access to any destination
2. Allow hosts on the 192.168.30.0/24 network ping access to any destination.
3. Deny any other access originating from the network.

My solution:
For 1)
R3(config)#access-list 101 permit tcp 192.168.30.0 0.0.0.255 any eq www
For 2)
R3(config)#access-list 101 permit icmp 192.168.30.0 0.0.0.255 any
For 3)
R3(config)#access-list 101 deny ip any any

This gives me no feedback ie it's wrong. WTF. Any help is appreciated.

 

[CGR]

Maybe this will help:

http://www.cisco.com/en/US/products...ucts_tech_note09186a00800a5b9a.shtml#acltypes

 

[=ACID RAIN=]

I just had a moment...

3. Deny any other access originating from the network.

R3(config)#access-list 101 deny ip 192.168.30.0 0.0.0.255 any
R3(config)#access-list 101 permit ip any any (maybe, not specified. Deny all is the default so I have to watch that)

Lemme see if that sets it off....

 

[=ACID RAIN=]

Nope. Didn't take. Screw it LOL.

 

[skidooosl]

When you say it gives no feedback... do you mean the access does not work?

did you remember to tie the access list to the correct interface I have been burned by that a number of times.... lol

 

[=ACID RAIN=]

No it's giving me a score when I have the *exact* answer, which is what I meant by feedback. The rules work, it's just not what cisco wanted. Usually that means there is a twist that you are missing, but in this case I just said screw it..

 

[skidooosl]

ah, I see what you mean now.... looks ok but I think I may see what is wrong...

have to remember Cisco is super anal about everything


R3(config)#access-list 101 permit icmp 192.168.30.0 0.0.0.255 any

^ this allows ALL ICMP to any destination^

the question asked only that only ping access be allowed

try to add ICMP echo or echo-reply to the end of the access list

or ICMP type codes 0 or 8

I bet that will fix it

 

[=ACID RAIN=]

I did try adding echo but I didn't try type codes. I may hack at it again tomorrow. Thanks!

 

[skidooosl]

it may be looking for echo-reply at the end of that access-list