17.12.2010 13:27, Oleg Gnedykh пишет:
Hi Guys!
Thank you very much for your answers.
But I've really wonted to enter into network from ANY addresses and
ONLY to definite access point. It is necessary because of different causes.
I have a router with several hundred IP-interfaces which different from
time to time.
Of course, I am able to attach ACL for all interfaces but instead this I want to
assign ONLY ONE IP-interface for access to my network.
And after that, I'll can to control and to guard only ONE interface.
IMHO, you can use CoPP to do that.
!
control-plane
service-policy input bla-bla-bla
!
In the policy-map you can define various criteria, ALC, policers, etc.
But care should be taken becaus this feauture applies to ALL traffic
going to router CPU including routing protocols, etc.
Hope this helps...
PS: Of course, The "access-list 111 deny ip any any log" need only for
logging and traps.
------------Quote-----------
I want to create a network with one entry point.
AFIK it's a best practise for network designing.
For example it maybe a something router with a Loopback interface.
I've created Loop0, ACL and attached it to "line vty"
interface Loopback10
description ### Manage ###
ip address 192.168.1.1 255.255.255.255
access-list 111 permit ip any host 192.168.1.1 log
access-list 111 deny ip any any log
line vty 0 4
access-class 111 in
And as a result I have connection refused
%SEC-6-IPACCESSLOGP: list 111 denied tcp 192.168.20.1(2683) -> 0.0.0.0(23), 1
packet
There is 192.168.20.1 is a local address for on my PC.
What can I do anything???
------------Quote-----------
With best regards, Oleg.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
--
Sincerely yours,
Artyom Viklenko.
-------------------------------------------------------
[email protected] | http://www.aws-net.org.ua/~artem
[email protected] | JID: [email protected]
FreeBSD: The Power to Serve - http://www.freebsd.org
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
