augh! grande access-list funziona, ma niente match...

sysnaz · ven 15 set , 2006 4:37 pm

Ho una access-list in ingresso su due ATM (una in backup all'altra), sulla quale, qualche settimana fa avevo notato un gran numero (un milione e spiccioli) di matches sulla regola:

access-list 106 permit tcp any my.smtp.server eq smtp

e gia`pensavo di spostarla piu'in alto nella lista quando ho notato che il
relativo contatore non si stava piu'incrementando. Strano, eppure la posta passa.
E passa su smtp. E passa in entrambi i versi sia entrante che uscente.
E l'smtp server e`proprio lui, quello della regola.
Azzero i contatori di quella lista. Da allora niente matches.
Sopra a quella permit niente che possa far pensare ad un permit che avviene prima di incontrare quella. infatti, per fare un esperimento, la sposto comunque in cima alla lista. Ancora niente matches.
Per prova, faccio fuori quella riga e la posta entrante non passa piu'.
Ripristino la riga che si trova ancora in cima alla lista, la posta ricomincia a passare ma i contatori rimangono a zero...
Sto quasi per credere che ci siano dei folletti dispettosi nel mio router....
voi avete qualche idea su cosa puo`indurre simili bizzarrie?
in generale, ci si puo' fidare delle matches delle regole?
ci sono folletti dentro al 7604 con cisco ios 12 e spiccioli?
grazie per eventuali risposte, ciao.

MaiO · ven 15 set , 2006 4:39 pm

Ma le FQDN funzionano nelle acl?

Ciao

sysnaz · ven 15 set , 2006 4:55 pm

MaiO ha scritto:Ma le FQDN funzionano nelle acl?

Ciao

no, nella regola c'e' l'indirizzo ip, l'ho sostituito con un nome solo
per evidenziare il ruolo della macchina...
ciao

MaiO · ven 15 set , 2006 5:16 pm

Se non ci fai vedere tutta l'acl, dove e come è applicata e gli indirizzi delle int non credo saremo in grado di aiutarti.

Ciao

sysnaz · ven 15 set , 2006 5:38 pm

1 di 2 (su cosa e'applicata)

backup:

interface ATM3/0/0.1 point-to-point
ip address 193.206.136.150 255.255.255.252
ip access-group 106 in
ip access-group 107 out
pvc garr2 250/100
cbr 33920
oam-pvc manage
encapsulation aal5snap

main:

interface ATM3/0/1.102 point-to-point
ip address 193.206.131.238 255.255.255.252
ip access-group 106 in
ip access-group 107 out
pvc garr2 250/102
cbr 149760
oam-pvc manage
encapsulation aal5snap

sysnaz · ven 15 set , 2006 5:54 pm

2 di 2
segue L'access-list (roba lunga...io l'ho "ereditata" quasi come e'...)

access-list 106 permit tcp any host 192.84.135.115 eq smtp
access-list 106 deny tcp any host 192.84.135.115 lt smtp
access-list 106 deny 53 any any
access-list 106 deny 55 any any
access-list 106 deny 77 any any
access-list 106 deny pim any any
access-list 106 deny icmp any any redirect
access-list 106 deny icmp any host 192.135.35.127
access-list 106 deny ip any host 192.84.135.255
access-list 106 deny ip any host 192.135.35.127
access-list 106 deny ip any host 192.135.35.255
access-list 106 deny ip any host 192.135.27.127
access-list 106 deny ip any host 192.135.27.255
access-list 106 deny ip any host 224.0.0.251
access-list 106 deny udp any any eq snmp
access-list 106 deny tcp any any eq 161
access-list 106 deny icmp any any ttl-exceeded
access-list 106 deny ip any 224.0.0.0 31.255.255.255
access-list 106 deny ip 224.0.0.0 31.255.255.255 any
access-list 106 deny tcp any any eq 139
access-list 106 deny tcp any any eq 445
access-list 106 deny udp any any eq netbios-ns
access-list 106 deny tcp any any eq 137
access-list 106 deny tcp any any eq 138
access-list 106 deny udp any any eq netbios-dgm
access-list 106 deny udp any any eq netbios-ss
access-list 106 deny udp any any eq 445
access-list 106 permit tcp any host 192.84.135.21 eq pop3
access-list 106 permit tcp any host 192.84.135.234 eq pop3
access-list 106 permit tcp any host 192.84.135.234 eq 993
access-list 106 permit ip any host 192.84.135.40
access-list 106 permit ip any host 192.84.135.41
access-list 106 permit ip any host 192.84.135.251 log
access-list 106 permit ip any host 192.84.135.204 log
access-list 106 deny ip 10.0.0.0 0.255.255.255 any
access-list 106 deny ip 192.84.135.0 0.0.0.255 any
access-list 106 deny ip 192.135.35.0 0.0.0.255 any
access-list 106 deny ip 192.135.27.0 0.0.0.255 any
access-list 106 deny ip 172.16.0.0 0.15.255.255 any
access-list 106 deny ip 192.168.0.0 0.0.255.255 any
access-list 106 deny ip host 0.0.0.0 any
access-list 106 deny ip 127.0.0.0 0.255.255.255 any
access-list 106 deny ip any host 192.84.135.8
access-list 106 deny ip any host 192.84.135.7
access-list 106 deny ip any host 192.84.135.100
access-list 106 permit tcp any host 192.84.135.11 eq www
access-list 106 permit tcp any host 192.84.135.25 eq www
access-list 106 permit tcp any 192.84.135.26 0.0.0.1 eq www
access-list 106 permit tcp any host 192.84.135.33 eq www
access-list 106 permit tcp any host 192.84.135.35 eq www
access-list 106 permit tcp any host 192.84.135.37 eq www
access-list 106 permit tcp any host 192.84.135.82 eq www
access-list 106 permit tcp any host 192.84.135.95 eq www
access-list 106 permit tcp any host 192.84.135.104 eq www
access-list 106 permit tcp any host 192.84.135.111 eq www
access-list 106 permit tcp any host 192.84.135.117 eq www
access-list 106 permit tcp any host 192.84.135.124 eq www
access-list 106 permit tcp any host 192.84.135.141 eq www
access-list 106 permit tcp any host 192.84.135.235 eq www
access-list 106 permit tcp any host 192.84.135.240 eq www
access-list 106 permit tcp any host 192.135.35.136 eq www
access-list 106 permit tcp any host 192.135.35.143 eq www
access-list 106 permit tcp any host 192.135.35.146 eq www
access-list 106 permit tcp any host 192.135.35.157 eq www
access-list 106 permit tcp any 192.135.35.168 0.0.0.1 eq www
access-list 106 permit tcp any host 192.135.35.173 eq www
access-list 106 permit tcp any host 192.135.35.177 eq www
access-list 106 permit tcp any host 192.135.35.180 eq www
access-list 106 permit tcp any host 192.135.35.204 eq www
access-list 106 permit tcp any host 192.135.35.210 eq www
access-list 106 permit tcp any host 192.135.35.215 eq www
access-list 106 permit tcp any host 192.135.35.229 eq www
access-list 106 permit tcp any host 192.84.135.234 eq 443
access-list 106 permit tcp any host 192.84.135.6 eq 443
access-list 106 permit tcp any host 192.84.135.25 eq 443
access-list 106 permit tcp any 192.84.135.26 0.0.0.1 eq 443
access-list 106 permit tcp any host 192.84.135.33 eq 443
access-list 106 permit tcp any host 192.84.135.35 eq 443
access-list 106 permit tcp any host 192.84.135.37 eq 443
access-list 106 permit tcp any host 192.84.135.55 eq 443
access-list 106 permit tcp any host 192.84.135.82 eq 443
access-list 106 permit tcp any host 192.84.135.95 eq 443
access-list 106 permit tcp any host 192.84.135.104 eq 443
access-list 106 permit tcp any host 192.84.135.111 eq 443
access-list 106 permit tcp any host 192.84.135.117 eq 443
access-list 106 permit tcp any host 192.84.135.124 eq 443
access-list 106 permit tcp any host 192.84.135.141 eq 443
access-list 106 permit tcp any host 192.84.135.235 eq 443
access-list 106 permit tcp any host 192.84.135.240 eq 443
access-list 106 permit tcp any host 192.135.35.136 eq 443
access-list 106 permit tcp any host 192.135.35.143 eq 443
access-list 106 permit tcp any host 192.135.35.146 eq 443
access-list 106 permit tcp any host 192.135.35.157 eq 443
access-list 106 permit tcp any 192.135.35.168 0.0.0.1 eq 443
access-list 106 permit tcp any host 192.135.35.173 eq 443
access-list 106 permit tcp any host 192.135.35.177 eq 443
access-list 106 permit tcp any host 192.135.35.180 eq 443
access-list 106 permit tcp any host 192.135.35.204 eq 443
access-list 106 permit tcp any host 192.135.35.210 eq 443
access-list 106 permit tcp any host 192.135.35.215 eq 443
access-list 106 permit tcp any host 192.135.35.229 eq 443
access-list 106 permit ip host 137.138.128.148 host 192.135.35.210
access-list 106 permit ip host 137.138.246.50 host 192.135.35.210
access-list 106 permit ip host 137.138.246.51 host 192.135.35.210
access-list 106 permit ip host 137.138.176.45 host 192.135.35.210
access-list 106 permit ip host 137.138.137.39 host 192.135.35.210
access-list 106 permit ip host 137.138.161.28 host 192.135.35.210
access-list 106 permit ip host 141.108.255.15 host 192.135.35.210
access-list 106 deny ip any host 192.135.35.210
access-list 106 permit ip host 137.138.128.148 host 192.135.35.229
access-list 106 permit ip host 137.138.246.50 host 192.135.35.229
access-list 106 permit ip host 137.138.246.51 host 192.135.35.229
access-list 106 permit ip host 137.138.176.45 host 192.135.35.229
access-list 106 permit ip host 137.138.137.39 host 192.135.35.229
access-list 106 permit ip host 137.138.161.28 host 192.135.35.229
access-list 106 permit ip host 141.108.255.15 host 192.135.35.229
access-list 106 deny ip any host 192.135.35.229
access-list 106 permit tcp host 192.84.154.30 host 192.84.135.4 eq domain
access-list 106 permit tcp host 192.167.13.102 host 192.84.135.4 eq domain
access-list 106 permit tcp host 193.204.1.1 host 192.84.135.4 eq domain
access-list 106 permit tcp host 131.154.1.3 host 192.84.135.16 eq domain
access-list 106 permit tcp any host 192.135.35.176 eq domain
access-list 106 permit udp any host 192.84.135.3 eq domain
access-list 106 permit udp any host 192.84.135.4 eq domain
access-list 106 permit udp any host 192.84.135.16 eq domain
access-list 106 permit udp any host 192.135.35.176 eq domain
access-list 106 permit tcp any host 192.135.35.176 eq smtp
access-list 106 permit gre host 131.154.1.5 host 192.84.135.8
access-list 106 permit gre host 141.108.5.80 host 192.84.135.8
access-list 106 permit ip host 193.206.131.237 host 193.206.131.238
access-list 106 permit ip host 193.204.114.1 host 193.206.136.150
access-list 106 permit ip host 193.206.136.149 host 193.206.136.150
access-list 106 permit ip host 193.206.158.32 host 193.206.136.150
access-list 106 permit ip host 193.206.158.32 host 193.206.131.238
access-list 106 permit ip host 193.204.114.1 host 193.206.136.150
access-list 106 permit ip host 193.206.136.149 host 193.206.136.150
access-list 106 permit ip host 193.206.158.32 host 193.206.136.150
access-list 106 permit ip host 193.206.158.32 host 193.206.131.238
access-list 106 permit ip host 193.206.80.121 host 192.84.135.254 log
access-list 106 permit ip host 193.206.80.122 host 192.84.135.254 log
access-list 106 permit ip host 192.84.129.16 host 192.84.135.254 log
access-list 106 permit ip host 193.206.84.48 host 192.84.135.254 log
access-list 106 permit ip host 193.206.80.240 host 192.84.135.254 log
access-list 106 permit ip host 192.84.129.13 host 192.84.135.254 log
access-list 106 permit ip host 193.206.84.208 host 192.84.135.254 log
access-list 106 permit ip host 193.206.85.81 host 192.84.135.254 log
access-list 106 permit ip host 193.206.85.37 host 192.84.135.254 log
access-list 106 permit ip host 193.206.84.171 host 192.84.135.254 log
access-list 106 permit ip host 192.84.129.15 host 192.84.135.254 log
access-list 106 deny tcp any host 192.84.135.254 lt 1024
access-list 106 deny udp any host 192.84.135.254 lt 1024
access-list 106 permit ip 217.223.196.128 0.0.0.31 host 192.84.135.11 log
access-list 106 permit ip host 81.73.168.191 host 192.84.135.11 log
access-list 106 deny ip any host 192.84.135.11
access-list 106 permit ip any host 192.135.35.161
access-list 106 permit tcp any host 192.84.135.1 eq 22
access-list 106 permit tcp any host 192.84.135.56 eq 22
access-list 106 permit tcp any host 192.84.135.67 eq 22
access-list 106 permit tcp any host 192.84.135.72 eq 22
access-list 106 permit tcp any host 192.84.135.133 eq 22
access-list 106 permit tcp any host 192.84.135.193 eq 22
access-list 106 permit tcp any host 192.84.135.199 eq 22
access-list 106 permit tcp any host 192.84.135.201 eq 22
access-list 106 deny tcp any host 192.84.135.1 lt 24
access-list 106 deny tcp any host 192.84.135.56 lt 24
access-list 106 deny tcp any host 192.84.135.67 lt 24
access-list 106 deny tcp any host 192.84.135.72 lt 24
access-list 106 deny tcp any host 192.84.135.133 lt 24
access-list 106 deny tcp any host 192.84.135.193 lt 24
access-list 106 deny tcp any host 192.84.135.199 lt 24
access-list 106 deny tcp any host 192.84.135.201 lt 24
access-list 106 deny tcp any host 192.84.135.21 lt 750
access-list 106 deny tcp any host 192.84.135.16 lt 1025
access-list 106 deny tcp any host 192.84.135.238 lt 22
access-list 106 permit tcp any host 192.84.135.199 eq 533
access-list 106 permit tcp any host 192.135.35.156 eq 533
access-list 106 permit udp any host 192.84.135.199 eq 533
access-list 106 permit udp any host 192.135.35.156 eq 533
access-list 106 permit tcp host 131.154.11.20 any eq 522
access-list 106 permit tcp host 131.154.11.20 any eq 389
access-list 106 permit tcp any host 192.135.35.143 eq 8080
access-list 106 permit tcp any host 192.84.135.27 eq 2704
access-list 106 permit tcp host 128.148.19.84 host 192.84.135.6
access-list 106 permit ip host 141.108.9.129 host 192.135.35.164
access-list 106 permit ip host 160.80.22.15 192.84.135.148 0.0.0.1
access-list 106 permit ip host 160.80.22.15 host 192.84.135.56
access-list 106 permit ip 160.80.22.16 0.0.0.1 192.84.135.148 0.0.0.1
access-list 106 permit ip 160.80.22.16 0.0.0.1 host 192.84.135.56
access-list 106 permit ip host 160.80.22.30 192.84.135.148 0.0.0.1
access-list 106 permit ip host 160.80.22.30 host 192.84.135.56
access-list 106 deny tcp any any lt ftp-data
access-list 106 permit tcp any any lt 24
access-list 106 permit tcp any any eq 123
access-list 106 permit tcp any any eq 750
access-list 106 permit tcp any any eq 407
access-list 106 deny tcp any any eq smtp
access-list 106 deny tcp any any lt 1024
access-list 106 deny tcp any any eq 1433
access-list 106 deny tcp any any eq 1080
access-list 106 deny tcp any any eq 1434
access-list 106 deny tcp any any eq 1900
access-list 106 deny tcp any any eq 2000
access-list 106 deny tcp any any eq 2049
access-list 106 deny tcp any any eq 2745
access-list 106 deny tcp any any eq 4000
access-list 106 deny tcp any any eq 4444
access-list 106 deny tcp any any eq 5000
access-list 106 deny tcp any any eq 5554
access-list 106 deny tcp any any eq 5999
access-list 106 deny tcp any any eq 6112
access-list 106 deny tcp any any eq 6129
access-list 106 deny tcp any any eq 6346
access-list 106 deny tcp any any eq 6699
access-list 106 deny tcp any any eq 8000
access-list 106 deny tcp any any eq 8080
access-list 106 deny tcp any any eq 8888
access-list 106 deny tcp any any eq 9000
access-list 106 deny tcp any any eq 9996
access-list 106 deny tcp any any eq 9999
access-list 106 deny udp any any lt 20
access-list 106 permit udp any any lt 24
access-list 106 permit udp any any eq ntp
access-list 106 permit udp any any eq 407
access-list 106 permit udp any any eq 750
access-list 106 deny udp any any lt 1024
access-list 106 deny udp any any eq 1434
access-list 106 deny udp any any eq 1433
access-list 106 deny udp any any eq 1900
access-list 106 deny udp any any eq 2000
access-list 106 deny udp any any eq 2049
access-list 106 deny udp any any eq 2745
access-list 106 deny udp any any eq 4000
access-list 106 deny udp any any eq 4444
access-list 106 deny udp any any eq 5000
access-list 106 deny udp any any eq 5554
access-list 106 deny udp any any eq 5999
access-list 106 deny udp any any eq 6112
access-list 106 deny udp any any eq 6129
access-list 106 deny udp any any eq 6346
access-list 106 deny udp any any eq 6699
access-list 106 deny udp any any eq 8000
access-list 106 deny udp any any eq 8080
access-list 106 deny udp any any eq 8888
access-list 106 deny udp any any eq 9000
access-list 106 deny udp any any eq 9996
access-list 106 deny udp any any eq 9999
access-list 106 permit ip any any

augh! grande access-list funziona, ma niente match...

Login • Iscriviti