From: Djerk Geurts (djerk.geurts@nl.easynet.net)
Date: Wed Aug 01 2007 - 17:31:14 ART
> -----Original Message-----
> From: Djerk Geurts
>
> No but a "deny ip any any" or "deny ospf any any" should
> match it alright imho...
>
> It seems that ospf circumvents the acl entirely. Which should
> not be surprising as this is known to be a problem in a few
> other cases as well.
>
> I'm trying a service-policy now, but according to a firned of
> mine it won't work either. So my only options left are to
> place and acl on the switch or configure non-broadcast (which
> is half a solution as mentioned before).
>
> The trouble is afaik an acl will be expected. How is one
> supposed to configure the lab when there's a script which
> check the configs and I know it won't read my comment in the
> interface description as to why there's no acl there...
>
> Djerk
>
> > -----Original Message-----
> > From: dayody@googlemail.com [mailto:dayody@googlemail.com] On
> > Behalf Of dayo@ademuyiwa.com
> > Sent: woensdag 1 augustus 2007 22:25
> > To: Djerk Geurts
> > Subject: Re: OSPF ACL
> >
> > have you tried it with IP ospf port number?
> >
> > On 8/1/07, Djerk Geurts <djerk.geurts@nl.easynet.net> wrote:
> > > If I want to block hello's from being sent out an interface on the
> > > router itself. Can I use an ACL? I've tried it and it
> > doesn't work...
> > >
> > > IOS: 3640 /w 12.4(8c) or 12.4(7e) IP+
> > >
> > > interface FastEthernet0/0
> > > description *** C3548 F0/3 - VL3 O#3 ***
> > > ip address 15.1.3.3 255.255.255.0
> > > ip access-group NACL-R3-F0/0-OUT out
> > > ip ospf 1 area 3
> > >
> > >
> > > R3#sh access-list
> > > Extended IP access list NACL-R3-F0/0-OUT
> > > 10 deny ip any host 224.0.0.5
> > > 20 deny ospf any host 224.0.0.5
> > > 30 deny ospf any any
> > > 40 permit ip any any
> > >
> > > R3#
> > > *Mar 17 00:01:32.891: OSPF: Send hello to 224.0.0.5 area 3 on
> > > FastEthernet0/0 from 152.1.3.3
> > > *Mar 17 00:01:32.891: IP: s=152.1.3.3 (local), d=224.0.0.5
> > > (FastEthernet0/0), len 76, sending broad/multicast
> > >
> > > The debug shows that the router generates and sends hellos, the
> > > interface counters increate as do the counters on the
> > attached switch.
> > > So all in all either one can't filter this on the router
> > itself and I
> > > need to config it on the switch. Or, these IOSes are
> broken. Or, I'm
> > > doing something utterly wrong.
> > >
> > > I do have another solution that does work which is to set
> > the network
> > > type to non-broadcast which stops the router from sending
> > hello's but if
> > > another device were to initiate a neighborship the router
> > would respond
> > > resulting in hellos being sent.
> > >
> > > --
> > > Djerk
> > > www.djerk.nl
> > >
> > >
> > ______________________________________________________________
> > _________
> > > Subscription information may be found at:
> > > http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Sat Sep 01 2007 - 11:32:09 ART