RE: Dynamic Access List

From: Aaron Pilcher (apilcher@itgcs.com)
Date: Sun Jul 30 2006 - 18:58:58 ART


Here is another spin on it....

Username user1 password pass1
Username user2 password pass2

Username user1 autocommand access-enable %optional things like timeout here%
Username user2 autocommand show version

Access-list 100 permit tcp any host 131.1.23.2 eq telnet
Access-list 100 permit ospf any any
Access-list 100 dynamic LOCKANDKEY permit tcp any any eq telnet

Interface fastethernet 0/0
 Ip access-group 100 in

Line vty 0 4
 Login local

In the above example once a user logs in as "user1" to the above router,
telnet traffic through this device will be permitted, and from what I have
seen immediately logged out.

Also, if the user logs in as "user2" the command "show version" will be
displayed and the user will be also, immediately logged out.

-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Narbik Kocharians
Sent: Sunday, July 30, 2006 4:38 PM
To: Sami
Cc: ccielab@groupstudy.com
Subject: Re: Dynamic Access List

Here is an example of a dynamic access-list, the external interface's IP
address of your router is 131.1.23.2 and the external host that needs access
to your internal network has an IP address of 2.2.2.2, I hope this helps:

Router(config)#access-list 100 permit tcp any host 131.1.23.2 eq 23

*This access-list is needed so the external users can telnet in, in order to
get authenticated. *

R2(config)#access-list 100 permit ospf any any

*This statement is needed to allow OSPF through (This is just an example)
but if you have other routing protocols running, you should allow that
traffic.*

R2(config)#access-list 100 dynamic TEST permit ip any any

*Note the above statement in the access-list tells the router to create a
dynamic access-list called TEST. This named access-list will be created when
external users telnet to this router and get authenticated. One of the
restrictions in dynamic ACL is that you can only configure one line.*

R2(config)#int s0/0

R2(config-subif)#ip access-group 100 in

*The above command is applying the access-list inbound to S0/0 interface.*

* *

* *

* *

*Lastly the telnet ports must be configured for the dynamic access-list:*

R2(config-subif)#line vty 0 871

R2(config-line)#autocommand ?

  LINE Appropriate EXEC command

  no-suppress-linenumber Display service linenumber message

*Note the access-enable may not show when a question mark is entered.*

R2(config-line)#autocommand access-enable host

R2(config-line)#login local

*The "autocommand" statement links the dynamic access-list to the telnet
authentication. It creates an entry in the dynamic access-list using the
source IP address of the host. If the autocommand is NOT configured, the
dynamic entry will not be created. *

*The second line specifies that authentication should be done using the
local user account database.*

This is the ACL that's created for you:

*On R2*

*Show access-list*

Extended IP access list 100

    10 permit tcp any host 131.1.23.2 eq telnet (207 matches)

    20 permit tcp any host 2.2.2.2 eq telnet

    30 permit ospf any any (175 matches)

    4*0 Dynamic TEST permit ip any any*

* permit ip host 131.1.34.4 any (6 matches)*

The external host's IP address is 2.2.2.2

Note if the timeouts are not specified the entry will be there forever,
unless you clear the dynamic entry using the following command:

R2#clear ip access-template 100 TEST host 131.1.34.4 any

*Note this command has to be entered in the privileged config mode. *

* *

*There are two timeout values, Idle and absolute and they are as follows:*

* *

R2(config)#line vty 0 871

R2(config-line)#autocommand access-enable host timeout 2

*The timeout here defines the idle timeout and it's in minutes.*

*Show ip access-list*

Extended IP access list 100
* *

    10 permit tcp any host 131.1.23.2 eq telnet (381 matches) **

    20 permit tcp any host 2.2.2.2 eq telnet

    30 permit ospf any any (574 matches)

    40 Dynamic TEST permit ip any any

       *permit ip host 131.1.34.4 any (1 match) (time left 95)*

This is the absolute timeout:

R2(config)#access-list 100 dynamic TEST timeout 4 permit ip any any

*This timeout is the absolute or time to live timeout, which defines the
amount of time in minutes a dynamically created access-list, can exist. *

Narbik Kocharians
CCIE# 12410 (R&S, SP, Security)
CCSI# 30832
Network Learning, Inc. (CCIE class Instructor)
www.ccbootcamp.com (CCIE Training)

On 7/30/06, Sami <sy1977@gmail.com> wrote:
>
> Group,
>
> Could some explain when dynamic access list is apllied to vty lines and
> when
> to a user using autocommand ? Another confustion timeout , should it be
> used
> with dynamic access list command or with autocommand when apllying to
> vyt/user.
>
> Could some one post a working config with an example.
>
> Thanks
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>

-- 
Narbik Kocharians
CCIE# 12410 (R&S, SP, Security)
CCSI# 30832
Network Learning, Inc. (CCIE class Instructor)
www.ccbootcamp.com (CCIE Training)


This archive was generated by hypermail 2.1.4 : Tue Aug 01 2006 - 07:13:48 ART