|
|
|
A new access list is required whenever you change a default port assignment. If, for example, you change the web server port from its default of 80 (or 443 for SSL), you must enable the new port with an access list and apply that list to the management module’s eth0 interface:
# assign new web server port ip http server port 7000 # create new access list to permit access to the new port from any host ip access-list my_new_access_list permit tcp 0.0.0.0. 255.255.255.255 0.0.0.0 255.255.255.255 eq 7000 end # apply new access list to eth0 interface on management module interface FastEthernet 0/0 ip access-group my_new_access_list in end
The problem with this example is the implicit deny command that the CNA system appends to all access lists by default. At the same time that your new access list has allowed use of port 7000, it has also denied use of all other ports on the interface.
Whenever you add an access list to an interface, you should re-enable default permissions which permit traffic required by the CNA system.
You should create your new access list as follows:
#create new access list ip access-list my_new_access_list # copy desired permit/deny commands from the Management Module example, but substitute # the following for the permit command that enables http on port 80 permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 7000 end
The permit command takes the IP address of the source of the incoming traffic as the first address argument and the address of the module interface--the packet destination--as the second address argument. Specifying these addresses as 0.0.0.0 255.255.255.255 means that any host, regardless of IP address, can send traffic to the designated port across any interface that is configured on the module.
As an additional security measure, you could use specific IP addresses. You can add a different permit command specifying as the source argument the IP address of each host you want to allow into the CNA system, and specifying as the destination argument the address you assigned to the management module’s eth0 port. This will limit access to the web server to only those hosts for which there is a permit command, and they will only have access to a single specified address.
If you had assigned address 1.2.3.4 to the management module’s fastethernet 0/0 interface (the eth0 interface), any of the permit commands in any of these access list examples could specify the actual address for the packet destination as in the following permit rule:
permit tcp 0.0.0.0. 255.255.255.255 1.2.3.4 0.0.0.0 eq 7000
|
|
|