Showing posts with label acl. Show all posts
Showing posts with label acl. Show all posts

Wednesday, 10 February 2021

vpn filter ACLs not working as expected

Had issues with VPN filter ACLs

Had some thing like

permit ip host x.x.x.x any

This should have allowed my traffic but it was not working


I needed to change this to which was essentially the same but it worked. It seems you need to make rules for the vpn filter ACLs in this way

permit ip 192.168.1.0 255.255.255.0 10.150.200.0 255.255.255.0

Monday, 1 February 2016

Allow ssh access to a cisco router

Since you don't have ssh already setup you'll probably need to connect with the console cable

Stop the annoying logs interrupting you on the console
line con 0
logging sync

Setting up a host name and domain name on the router
conf t
hostname R1
ip domain name example.com

Generate your keys
conf t
crypto key generate rsa
Key length should be 1024 (Need at least 1024 for ssh version2)

Configure a username and password
username admin priv 15 secret mypassword
password mypassword will be stored in plain text
secret mypassword will be stored in md5 hash

Enable aaa
aaa new-model (make the router ask for a username and a password)

enable secret myenablepw

Turn off telnet
line vty 0 4 (on router)
line vty 0 15 (on switch)
line vty 0 4
transport input ssh

Named Access-list
*** Important to type ip in front of access-list if you are used to ASA ***
*** Don't for get to look for access lists under the vty lines ***
ip access-list extended MYACL_NAME permit tcp host s.s.s.s host d.d.d.d eq 22
int g0/0
ip access-group MYACL_NAME in

Numbered Access-list
access-list 150 permit tcp host s.s.s.s host d.d.d.d eq 22
int g0/0
ip acccess-group 150 in


Example ACL
ip access-list extended OUTSIDE_IN
    10 permit tcp host x.x.x any
    20 permit tcp host y.y.y.y any
    30 permit tcp z.z.z.z 0.0.0.15 (networks need to be added with wildcard)
    200 deny ip any any log

interface Dialer1
ip access-group OUTSIDE_in in