If you wanted to use an extended access list then you have got it the wrong way round, you have specified in access-list 111 that any host can connect to 192.168.1.1 when you should really put:
access-list 111 permit ip host 192.168.20.1 any log And you do not need the second statement, unless you want to log denied requests, in which case your second line is correct. On 16 Dec 2010, at 13:25, Oleg Gnedykh wrote: > Hi Guys! > > I want to create a network with one entry point. > AFIK it's a best practise for network designing. > For example it maybe a something router with a Loopback interface. > I've created Loop0, ACL and attached it to "line vty" > > interface Loopback10 > description ### Manage ### > ip address 192.168.1.1 255.255.255.255 > > access-list 111 permit ip any host 192.168.1.1 log > access-list 111 deny ip any any log > > line vty 0 4 > access-class 111 in > > > And as a result I have connection refused > %SEC-6-IPACCESSLOGP: list 111 denied tcp 192.168.20.1(2683) -> 0.0.0.0(23), 1 > packet > There is 192.168.20.1 is a local address for on my PC. > > What can I do anything??? > > With best regards, Oleg. > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
