Hi Steve Thank you.
I don't understand why I can access http://192.168.0.115 if this access-list is valid ? My access list doesn't block www traffic to http://192.168.0.115 but block telnet / www to switch 192.168.0.118 I also don't understand about "access-list 120 permit any any" If I have hundred access lists, I have to put this "permit any any" at the end of each of hundred access-list Thank you for your help On Wed, Feb 4, 2009 at 9:10 AM, Steve Bertrand <[email protected]> wrote: > Deric Kwok wrote: > > Hi All > > > > I am new in cisco and trying to config the access list in my switch > > > > My switch ip is 192.168.0.118 > > > > I am trying to block the http traffic in the host 192.168.0.115 > > > > When I do it in, I can not accces the switch ! > > But I can access http://192.168.0.115 > > > > Can you help what is wrong? > > Can you give me examples? > > > > This rule states "deny tcp traffic from any host, to 192.168.0.115, port > 80" > > > access-list 120 deny tcp any host 192.168.0.115 eq www any log > > This rule states that you want to allow the rest of all traffic to .115 > > > access-list 120 permit ip any host 192.168.0.115 > > Now, by default, without any other rules, the switch denies ALL other > traffic implicitly, including traffic destined to the management IP on > the switch itself. > > To allow ALL other traffic to travel into, out of and to the switch, add: > > # access-list 120 permit any any > > ...which will allow ALL other traffic to and from all ports, to any IP > address at any port. > > I'd recommend permitting what you want explicitly, and then > deny-by-default, but the above will get you back up and going. > > > I also don't understand the access list only for deny 192.168.0.115. > > Why it blocks me in switch 192.168.0.118. but 192.168.0.115 is still > fine? > > See above. > > Steve > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
