access-list

[whitediver]

sh ver

Код: Выделить всё

Cisco IOS Software, SB101 Software (SB101-K9OY6-M), Version 12.3(8)YG4, RELEASE SOFTWARE (fc1)
Synched to technology version 12.3(10.3)T2
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Thu 04-May-06 00:56 by ealyon

ROM: System Bootstrap, Version 12.2(11r)YV5, RELEASE SOFTWARE (fc1)
ROM: Cisco IOS Software, SB101 Software (SB101-K9OY6-M), Version 12.3(8)YG4, RELEASE SOFTWARE (fc1)

ekb-gate uptime is 1 hour, 21 minutes
System returned to ROM by power-on
System restarted at 17:38:05 YEKST Thu Oct 28 2010
System image file is "flash:sb101-k9oy6-mz.123-8.YG4.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco SB101 (MPC857DSL) processor (revision 0x400) with 58983K/6553K bytes of memory.
Processor board ID FHK103613HV (2812965413), with hardware revision 0000
CPU rev number 7
2 Ethernet interfaces
128K bytes of NVRAM.
12288K bytes of processor board System flash (Read/Write)
2048K bytes of processor board Web flash (Read/Write)

Configuration register is 0x2102

кусок конфига про

ip access-list extended NAT
remark NAT access-list, Ethernet0 interface
permit ip 192.168.20.0 0.0.0.255 host 192.168.20.250
deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
permit ip 192.168.0.0 0.0.255.255 any
ip access-list extended VoIP
permit udp host 192.168.20.102 range 23000 24999 any range 23000 24999
logging facility local1
logging 192.168.20.100
access-list 101 remark Outbound access list (101), Ethernet 1 interface
access-list 101 deny ip any host 127.0.0.1 log
access-list 101 deny ip any 10.0.0.0 0.255.255.255 log
access-list 101 deny ip any 192.168.0.0 0.0.255.255 log
access-list 101 permit esp host 217.174.172.17 any
access-list 101 permit udp host 217.174.172.17 eq isakmp any eq isakmp
access-list 101 permit gre host 217.174.172.17 any
access-list 101 permit tcp host 217.174.172.17 any established
access-list 101 permit icmp host 217.174.172.17 any
access-list 101 permit udp host 217.174.172.17 eq domain any
access-list 101 permit udp host 217.174.172.17 any eq domain
access-list 101 permit tcp host 217.174.172.17 any eq domain
access-list 101 permit tcp host 217.174.172.17 any eq 953
access-list 101 permit udp host 217.174.172.17 any eq 3130
access-list 101 permit tcp host 217.174.172.17 any eq whois
access-list 101 permit tcp host 217.174.172.17 any eq smtp
access-list 101 permit tcp host 217.174.172.17 any eq ident
access-list 101 permit tcp host 217.174.172.17 any eq ftp
access-list 101 permit tcp host 217.174.172.17 any eq ftp-data
access-list 101 permit tcp host 217.174.172.17 any eq 122
access-list 101 permit tcp host 217.174.172.17 any eq 222
access-list 101 permit tcp host 217.174.172.17 any eq pop3
access-list 101 permit tcp host 217.174.172.17 any eq 22
access-list 101 permit tcp host 217.174.172.17 any eq www
access-list 101 permit tcp host 217.174.172.17 any eq 443
access-list 101 permit tcp host 217.174.172.17 any gt 1000
access-list 101 permit udp host 217.174.172.17 range 23000 23015 any
access-list 101 permit udp host 217.174.172.17 eq 5060 any
access-list 101 deny ip any any log
access-list 102 remark Outbound access list (101), Ethernet 1 interface
access-list 102 remark Inbound access list (102), Ethernet 1 interface
access-list 102 deny ip any 10.0.0.0 0.255.255.255
access-list 102 deny ip any 192.168.0.0 0.0.255.255
access-list 102 permit tcp any host 217.174.172.17 established
access-list 102 permit esp any host 217.174.172.17
access-list 102 permit udp any eq isakmp host 217.174.172.17 eq isakmp
access-list 102 permit gre any host 217.174.172.17
access-list 102 permit tcp any host 217.174.172.17 eq smtp
access-list 102 permit tcp any host 217.174.172.17 eq 465
access-list 102 permit udp any eq domain host 217.174.172.17
access-list 102 permit tcp any eq domain host 217.174.172.17
access-list 102 permit tcp any host 217.174.172.17 eq domain
access-list 102 permit udp any host 217.174.172.17 eq domain
access-list 102 permit tcp any host 217.174.172.17 eq 953
access-list 102 permit tcp any eq ftp-data host 217.174.172.17 gt 1024
access-list 102 permit icmp any host 217.174.172.17
access-list 102 permit tcp any host 217.174.172.17 eq 122
access-list 102 permit ip host 212.57.188.69 host 217.174.172.17
access-list 102 permit tcp any host 217.174.172.17 eq 993
access-list 102 permit tcp any host 217.174.172.17 eq 222
access-list 102 permit udp any host 217.174.172.17 range 23000 23015
access-list 102 permit tcp any host 217.174.172.17 eq 1720
access-list 102 permit udp any host 217.174.172.17 eq 5060
access-list 102 deny ip any any log
access-list 111 remark Outbound access list (111), interface Ethernet0
access-list 111 permit tcp any any established
access-list 111 permit ip any host 192.168.20.100
access-list 111 permit ip any host 192.168.20.101
access-list 111 permit ip any host 192.168.20.102
access-list 111 permit ip 192.168.0.0 0.0.255.255 192.168.20.0 0.0.0.255
access-list 111 deny ip any any log
access-list 112 remark Inbound access list (112), interface Ethernet0
access-list 112 permit ip host 192.168.20.100 any
access-list 112 permit ip host 192.168.20.101 any
access-list 112 permit ip host 192.168.20.102 any
access-list 112 permit ip 192.168.20.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 112 permit tcp 192.168.20.0 0.0.0.255 host 79.172.59.16 eq 1723
access-list 112 deny ip any any log

Из этого видно что из локалки до циски могут достучаться только 100, 101 и 102, мне же нужны ещё 2 IP.

Я попробовал сделать следующее:

Код: Выделить всё

#enable
#conf t
#no ccess-list 112 deny   ip any any log
#access-list 112 permit ip host 192.168.20.18 any

После чего сеанс ssh через putty благополучно завис, циска перестала пинговаться и интернет у всех упал.
Циске отрубил электричество, включил обратно, интернет заработал, а я вылез сюда и прошу мне помочь.

Возможно надо было начинать с 111 листа и возможно надо было удалить и то что выделено жирным, но...
С Циско раньше дел не имел, вообще мало с чем имел дело

ЗЫ: то что выделено жирным вообще не пойму. Что это значит?

Товарищи помогите как можно скоро, ночую сейчас в другом городе в офисе сейчас из-за этой богадельни

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[DenisKh]

Код: Выделить всё

access-list 113 remark Inbound access list (112), interface Ethernet0
access-list 113 permit ip host 192.168.20.100 any
access-list 113 permit ip host 192.168.20.101 any
access-list 113 permit ip host 192.168.20.102 any
access-list 113 permit ip 192.168.20.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 113 permit tcp 192.168.20.0 0.0.0.255 host 79.172.59.16 eq 1723
access-list 113 deny ip any any log
no access-list 112

Если мне не изменяет память то когда ты дал команду no access-list 112 deny ip any any log, ты тем самым убил полностью список доступа под номером 112 т.к у тебя используются стандартные списки, что бы избежать такой проблемы используй именованные списки доступа, ими по крайне мере управлять удобней.

Описание типов списков доступа http://www.opennet.ru/base/cisco/access ... o.txt.html

[whitediver]

Большое спасибо.
Правда я тогда-же ночью и разобрался, но за именованные списки большое спасибо

[DenisKh]

Да не за что Обращайтесь
буду рад помочь