GroupStudy.com GroupStudy.com - A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
Internet Firewall Router IOS Config posted 09/06/2001
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]


I have been using all my CCIE-candidate access-list & NAT
troubleshooting skills to figure out the config on our new
firewall/router but with no luck. When this access-list is put in place,
DNS inquiries from the servers that the access-list permits on port 53
(for DNS) stop working.

Is this access-list configured correctly for DNS?

Any help is appreciated!

Thanks,
David

The servers on 63.161.251.4 and .5 are our two DNS servers that do not
function once the access-list is put in place.



!
! Last configuration change at 03:11:43 CST Wed Mar 3 1993 by root
! NVRAM config last updated at 03:23:44 CST Wed Mar 3 1993 by root
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname inetrouter
!
logging buffered 4096 notifications
enable secret 5 $1$xZE9$KX4QfCbWvk.x1zFXLGHHg.
!
username root privilege 15 password 7 05070F1924455A1C09
memory-size iomem 20
clock timezone CST -6
clock summer-time CDT recurring
ip subnet-zero
no ip source-route
ip rcmd rsh-enable
ip rcmd remote-host root 17.0.26.1 root enable
ip rcmd remote-username root
no ip domain-lookup
!
!
!
 !
 !
 !
 !
 interface Ethernet0/0
 ip address 192.168.0.1 255.255.255.252 secondary
 ip address 192.168.1.1 255.255.255.252 secondary
 ip address 17.0.21.21 255.0.0.0
 no ip directed-broadcast
 no ip proxy-arp
 ip nat inside
 no cdp enable
!
interface Serial0/0
 description Internet T1
 ip address 144.232.221.38 255.255.255.252
 ip access-group 100 in
 no ip directed-broadcast
 no ip proxy-arp
 ip nat outside
 encapsulation ppp
 no cdp enable
!
ip nat inside source static 17.0.27.254 63.161.251.9
ip nat inside source static 17.0.18.254 63.161.251.8
ip nat inside source static 17.0.26.1 63.161.251.6
ip nat inside source static 17.0.17.254 63.161.251.4
ip nat inside source static 17.0.39.254 63.161.251.3
ip nat inside source static 17.0.19.254 63.161.251.5
ip nat inside source static 192.168.0.2 63.161.251.1
ip nat inside source static 192.168.1.2 63.161.251.7
ip nat inside source static 17.0.22.254 63.161.251.2
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0 2
no ip http server
!
logging 17.0.19.254
access-list 100 permit ip any host 63.161.251.7
access-list 100 permit ip any host 63.161.251.1
access-list 100 permit tcp any host 63.161.251.2 eq 443
access-list 100 permit tcp any host 63.161.251.2 eq 80
access-list 100 permit tcp any host 63.161.251.2 eq 25
access-list 100 permit tcp any host 63.161.251.4 eq 53
access-list 100 permit tcp any host 63.161.251.5 eq 53
access-list 100 permit udp any host 63.161.251.4 eq 53
access-list 100 permit udp any host 63.161.251.5 eq 53
access-list 100 permit udp any host 63.161.251.4 eq 123
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any host 63.161.251.2 echo
access-list 100 deny   ip any any log
no cdp run
!
line con 0
 exec-timeout 0 0
 login local
 transport input none
line aux 0
 password 7 14141B180F0B
line vty 0 4
 login local
!
ntp clock-period 17208398
ntp server 17.253.100.1
no scheduler allocate
end
**Please read:http://www.groupstudy.com/list/posting.html
_______________________________________________________
To unsubscribe from the CCIELAB list, send a message to
majordomo@xxxxxxxxxxxxxx with the body containing:
unsubscribe ccielab