I think you forgot about the implicit deny rule.
Anything not specifically granted is denied when an access list is defined.
Hope this helps,
_M
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of Tim
| Sent: Monday, September 03, 2001 12:20 PM
| To: Akatosh
| Cc: Imail
| Subject: RE: [IMail Forum] Block NNTP in Cisco
|
|
|
| Ok, well I did this and locked myself out of the router totally.
| I applied
| it to both the serial and the Ethernet ports and as soon as I hit enter,
| bam, I was blocked. I guess it didn't see the eq 119 part. I'm afraid to
| try it again!
|
| Any ideas on why it would not see the port 119 part of the
| command? I guess
| I will have to find the archives for any other answers to my
| question as it
| has been down since I made my attempt. :)
|
| Tim
|
|
| conf t
| acc 101 deny tcp any any eq 119
| acc 101 deny tcp any eq 119 any
|
| then apply it to an interface the person is on like this
| int serial0/0
| ip access-group 101 in
|
|
| and there ya go, no nntp in either direction
|
| the syntax for that is like this
| acc 101 [permit or deny] [ip/tcp/udp/icmp] from frommask to tomask
|
| eq ## can be thrown in after an address/mask to specify a port, 'any' is a
| shortcut for '0.0.0.0 255.255.255.255'
|
| search for the access-list command on cisco's website for better
| documentation
|
| On Sun, 2 Sep 2001, Tim wrote:
|
| > Anyone know the EXACT command needed to block ALL NNTP (port 119) access
| to
| > and from a network from a command prompt in a Cisco router?
| >
| > I have a customer who's network admin has hijacked a few of
| their servers
| > (linux) and is using them to run a news server, ftp server and I want to
| > shut them off by blocking them from the router which I do have
| the proper
| > passwords for..where I don't for the linux boxes. And, I am 1800 miles
| away
| > from either!
| >
| > Tim
| >
| >
| >
| >
| >
| >
| > _______________________________________________________________
| > Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
| http://noveltymail.com to get your own free email using this or ANY of our
| fun domain names.
| >
| > Please visit http://www.ipswitch.com/support/mailing-lists.html
| > to be removed from this list.
| >
| > An Archive of this list is available at:
| > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
| >
| >
|
| --
| Edward Fahner
| Systems Administrator, Planet Communications Network
| (540)442-6677 x222 [aka. Akatosh .CU.Au, [EMAIL PROTECTED]]
| DC2.DwGmL--WT--SksCre+\Cvi+BflA(+r-v+++)N^MH+$-Fj~R+Ac+++!J+S+U-I-
| -#V+++Q+Tc
| ++
|
|
|
|
|
|
| _______________________________________________________________
| Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
http://noveltymail.com to get your own free email using this or ANY of our
fun domain names.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
