ACL on Cat2950

Question

I need to filter WWW traffic via ACL on my 2950. What I would like to do is say deny all WWW traffic accept for my intranet site. I can't seem to get passed the sequence of commands. Any suggestions? Vlad

Answer 1

Actually, it appears that you can do this with a 2950, much to my surprise. Take a look at the URL below:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12120ea2/2950cr/cli1.htm#wp3460366
The biggest requirement is that you have a 2950 with an EI license. In the scenario described, the ACL would look something like:
access-list 100 permit tcp any host eq www
access-list 100 deny tcp any any eq www
access-list 100 permit ip any
Once you have the ACL built, you then need to associate it to a physical interface. This would look like:
interface FastEthernet0/1
ip access-group 100 in
Looking at the ACL and how it is applied to the interface, the first line allows any system that traffic passes through FastEthernet0/1 to communicate to the IP address of your Intranet webserver. The second line of the ACL denies all other www traffic. The third line of the ACL permits all remaining IP traffic. Without the third line, all traffic will be denied based on the implicit deny any any as the last line of all ACL's.
One other thing to consider would be if you are using HTTPS on your intranet site. If so, you will need to add an entry in the ACL that looks like:
access-list 100 permit tcp any host eq 443
access-list 100 deny tcp any any eq 443
These two additional entries should bee placed before the final line in the ACL. You will also need to place an entry for all IP addresses of your intranet webservers that you want to allow access to. Just repeat the same ACL entries adjusting for the IP's of your webservers. If all of your webservers are on a single subnet, you can replace the host with the subnet address by using 192.168.1.0 0.0.0.255 (I'm using this subnet as an example, replace with the appropriate one if applicable.)
You can also apply this ACL to multiple interfaces without having to define an ACL per interface unless you have different policies that you would like to apply.
HTH
Steve