Distribute list access list question

Can some one tell me what this access list would be doing?

who would you configure a list to deny "any to any host" and then allow "ip any" what effect does this have.

I am just looking on a router that I have taken over and before I make changes I was wondering why this has been done? Can any one tell me what enabling this will actually be doing?

router ospf 100
 router-id ########
 redistribute connected
 redistribute static subnets route-map STOPUPDATE
 network ####### 0.0.0.1 area 0
 network ######2 0.0.0.1 area 0
 neighbor #######1
 neighbor #######2
 neighbor #######3
 distribute-list 110 in
!
!
access-list 110 deny   ip host 0.0.0.0 host 0.0.0.0
access-list 110 permit ip any any

cheers

Find more posts tagged with

Comments

ingrown

Looks to me like it is just blocking a default route from coming in via OSPF.

wave

ingrown wrote: »

Looks to me like it is just blocking a default route from coming in via OSPF.

I second this.

MrBishop

Actually, I think its actually blocking its own networks from coming back into the network. The 0.0.0.0 means "this network" so its stopping its own private networks from coming back in.(looping I guess)

Reference:
RFC 3330 - Special-Use IPv4 Addresses

networker050184

That's not the case here MrBishop. When you use an extended access-list with the distribute list you specify the network and mask. This 0/0 will match a default route as pointed out by others.

DevilWAH

Of course now you say it jogs that old memory burried down in there

I tell you this network is so convulted in how its been setup, get fun tidying it all up though.

Cheers Guys

MrBishop

I"m going to keep believing that the purpose of this config is to stop any networks that are associated with its connected interfaces to be block from being redistributed(updated) back into the network from other neighbors. I could be wrong but I'm working on finding out the correct answer.

networker050184

You are more than free to believe what you want, but in this instance you are mistaken. Fire up a quick lab in GNS3 and let us know the results!

wave

MrBishop wrote: »

I"m going to keep believing that the purpose of this config is to stop any networks that are associated with its connected interfaces to be block from being redistributed(updated) back into the network from other neighbors. I could be wrong but I'm working on finding out the correct answer.

If it were do to that the ACL would not include the host parameter. The above statement does an exact match on 0.0.0.0