Here's a Cisco ACL you're welcome to review/implement: access-list 101 permit tcp any any established access-list 101 deny udp any any eq netbios-dgm access-list 101 deny udp any any eq netbios-ns access-list 101 deny tcp any any eq 139 access-list 101 permit ip any any ! remark *** bogons (bogus outside networks) deny ip 0.0.0.0 1.255.255.255 any deny ip 2.0.0.0 0.255.255.255 any deny ip 5.0.0.0 0.255.255.255 any deny ip 7.0.0.0 0.255.255.255 any deny ip 10.0.0.0 0.255.255.255 any deny ip 23.0.0.0 0.255.255.255 any deny ip 27.0.0.0 0.255.255.255 any deny ip 31.0.0.0 0.255.255.255 any deny ip 36.0.0.0 1.255.255.255 any deny ip 39.0.0.0 0.255.255.255 any deny ip 41.0.0.0 0.255.255.255 any deny ip 42.0.0.0 0.255.255.255 any deny ip 49.0.0.0 0.255.255.255 any deny ip 50.0.0.0 0.255.255.255 any deny ip 58.0.0.0 1.255.255.255 any deny ip 60.0.0.0 0.255.255.255 any deny ip 70.0.0.0 1.255.255.255 any deny ip 72.0.0.0 7.255.255.255 any deny ip 82.0.0.0 1.255.255.255 any deny ip 84.0.0.0 3.255.255.255 any deny ip 88.0.0.0 7.255.255.255 any deny ip 96.0.0.0 31.255.255.255 any deny ip 169.254.0.0 0.0.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 192.0.2.0 0.0.0.255 any deny ip 192.168.0.0 0.0.255.255 any deny ip 197.0.0.0 0.255.255.255 any deny ip 198.18.0.0 0.1.255.255 any deny ip 201.0.0.0 0.255.255.255 any deny ip 222.0.0.0 1.255.255.255 any deny ip 224.0.0.0 31.255.255.255 any ! remark *** protocols remark *** legacy small services no longer used deny tcp any any range 0 19 deny udp any any range 0 19 remark *** snmp deny tcp any any range 161 162 deny udp any any range 161 162 deny tcp any any eq 199 deny udp any any eq 199 deny tcp any any eq 391 deny udp any any eq 391 deny tcp any any eq 705 deny udp any any eq 705 deny tcp any any eq 1993 deny udp any any eq 1993 remark *** lan-only dhcp and tftp deny udp any any range 67 69 deny tcp any any range 67 69 remark *** microsoft netbios deny tcp any any range 135 139 deny udp any any range 135 139 deny tcp any any eq 445 deny udp any any eq 445 remark *** SQLSlammer worm deny udp any any eq 1434 remark *** unix rpc deny tcp any any eq 111 deny udp any any eq 111 remark *** lan-only unix services deny tcp any any range 511 515 deny udp any any range 511 515 remark *** ircd deny tcp any any eq 6667 deny udp any any eq 6667 remark *** icmp fragments deny icmp any any fragments remark *** inbound ping permit icmp any any echo remark *** inbound ping response permit icmp any any echo-reply remark *** path MTU to function permit icmp any any packet-too-big remark *** flow control permit icmp any any source-quench remark *** time exceeded messages for traceroute and loops permit icmp any any time-exceeded remark *** block all other ICMP packets deny icmp any any remark *** permit everything else permit ip any any
~Rick > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of JW > Sent: Sunday, January 26, 2003 10:25 AM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] CISCO help -- please respond off list > > > I think what cisco wants you to do is to create a text file with > all your access-list in it and the one you want to delete is to > just leave it out. Copy the access-list as they are since access- > list are implemented in the order in which they are entered. > Create the access-list as they are in the pix or router in the > text file, delete the access-list you don't want, copy and paste > the ammended access-list from the text file. Before you do this, > back up the config to a tftp server which can be your laptop. Tftp > software is available from cisco or download pumpkin from > 2cows.com. I think that is the website. > > > ---------- Original Message ---------------------------------- > From: David Dodell <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Sat, 25 Jan 2003 11:06:12 -0700 > > I need to delete an access list on my cisco router ... can't find > the > right command on the CISCO website. > > If I have an access-group 110 I thought the command was > > no ip access-group 110 no in > > Do I have something wrong? > > Help! > > David Dodell > > ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
