From: Hansang Bae (hbae@nyc.rr.com)
Date: Wed Oct 16 2002 - 01:30:12 GMT-3
At 06:34 PM 10/15/2002 +0200, Alberto Garcia wrote:
> Does anybody know, why when you use dynamic acl you can't do a
>telnet to the equipment? And if does it exist anyway to correct this?
>[snip] line vty 0 4
> password cisco
> login
> autocommand access-enable host timeout 1
>
> And whe you try to telnet though any interface you always receive
>the next message after the authentication:
>
> Password:
> List#130-firewall already contains this IP address pair
> [Connection to 192.138.2.2 closed by foreign host]
Use rotary command on the last vty.
**************************************************************************
From: Question 48
Date: 02 February 2002
Subject: How do I setup Lock & Key ACL? Or punch temporary holes in my
ACL if someone authenticates to my router?
Answer by: Hansang Bae <hbae_@_nyc.rr.com.REMOVE_>
username foobar password cisco
!
int s0
ip address 1.1.1.1 255.255.0.0
ip access-group 101 in
! /* or port 22 for ssh */
access-list 101 permit tcp any host 1.1.1.1 eq telnet
access-list 101 dynamic foobar permit ip any any
!
line vty 0 2
login local
autocommand access-enable host timeout 5
line vty 3 4
login local
rotary 1
The first access list allows telnet into the router. Your users will
telnet into router and authenticate with username foobar and password
"cisco"
The router will then immediately disconnect the telnet session. When
they successfully authenticate, an access list with their source IP will
be added to the dynamic list. Basically, if they authenticate correctly,
they can come in to the inside network. After 5 mins of inactivty the
entry will be deleted from the access list.
The vty 3 and 4 are using the rotary command so that you can telnet to
your router with the command: "telnet 1.1.1.1 3001" This takes you to
vty 3 (or 4). This way, you can telnet into the router and actually
manage it. A very subtle but VERY important point. If you forget this,
you'll be making a trip to use the console port.
**************************************************************************
This archive was generated by hypermail 2.1.4 : Tue Nov 05 2002 - 08:35:47 GMT-3