Newsgroup: it.comp.reti.cisco
Titolo: Semplice access-list per 2600

Ciao,
chi mi puo' riportare una access-list semplice che mi blocchi lo 
spoofing della rete lan?
La LAN possiede 4 classi C accessibili dall'esterno che, finora, non 
possedevano alcuna access-list.
Non voglio blindare troppo la LAN, pero' vorrei mettere alcune acl di 
base, cosa mi consigliate?
Grazie.

Dopo alcune ricerche rispondo a me stesso... spero di essere d'aiuto a 
qualcuno ;-)
--xo<---xo<---xo<---
Da: 
http://www.ibiblio.org/security/articles/ports.html
To block spoofed and private IP Address you will want an access list 
similar to the following; this example assumes your IP Address space is 
the class 'B' subnet 
152.2.0.0/16
:
Incoming Access List:
deny ip 152.2.0.0 0.0.255.255 any (Blocks spoofing your of IP Addresses)
deny ip 10.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 127.0.0.0 0.255.255.255
permit ip any any (anchor statement to allow legitmate access to your 
network)
Outgoing Access List:
deny ip 10.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip any 10.0.0.0 0.255.255.255
deny ip any 127.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255
permit ip 152.2.0.0 0.0.255.255 any (Allows your IP Address to access 
the Internet)
--xo<---xo<---xo<---

Visto che ci sei potresti aggiungerci anche un po di altre ACL...
esempio...
blocco di trinoo
Router(config-ext-nacl)#deny tcp any any eq 1524
Router(config-ext-nacl)#deny tcp eq 1524 any any
Router(config-ext-nacl)#deny udp eq 1524 any any
Router(config-ext-nacl)#deny tcp any any eq 27665
Router(config-ext-nacl)#deny tcp any eq 27665 any
Router(config-ext-nacl)#deny tcp any any eq 27444
Router(config-ext-nacl)#deny tcp any eq 27444 any
Router(config-ext-nacl)#deny tcp any any eq 31335
Router(config-ext-nacl)#deny tcp any eq 31335 any
blocco di stacheldraht
Router(config-ext-nacl)#deny tcp any any eq 16660
Router(config-ext-nacl)#deny tcp any eq 16660 any
Router(config-ext-nacl)#deny tcp any any eq 65000
Router(config-ext-nacl)#deny tcp any eq 65000 any
blocco di trinity
Router(config-ext-nacl)#deny tcp any any range 6665 6669
Router(config-ext-nacl)#deny tcp any range 6665 6669 any
Router(config-ext-nacl)#deny tcp any any eq 32270
Router(config-ext-nacl)#deny tcp any eq 32270 any
Router(config-ext-nacl)#deny tcp any any eq 39168
Router(config-ext-nacl)#deny tcp any eq 39168 any
blocco di subseven
Router(config-ext-nacl)#deny tcp any any eq 1080
Router(config-ext-nacl)#deny tcp any any eq 1243
Router(config-ext-nacl)#deny tcp any any eq 1369
Router(config-ext-nacl)#deny tcp any any eq 1999
Router(config-ext-nacl)#deny tcp any any eq 2222
Router(config-ext-nacl)#deny tcp any any range 2772 2774
Router(config-ext-nacl)#deny tcp any any eq 5873
Router(config-ext-nacl)#deny tcp any any eq 6667
Router(config-ext-nacl)#deny tcp any any range 6711 6713
Router(config-ext-nacl)#deny tcp any any eq 6669
Router(config-ext-nacl)#deny tcp any any eq 6676
Router(config-ext-nacl)#deny tcp any any eq 7000
Router(config-ext-nacl)#deny tcp any any eq 7215
Router(config-ext-nacl)#deny tcp any any eq 16959
Router(config-ext-nacl)#deny tcp any any eq 27573
Router(config-ext-nacl)#deny tcp any any eq 54283
blocco di back orifice
Router(config-ext-nacl)#deny udp any any eq 31337
Router(config-ext-nacl)#deny tcp any any range 31337 31338
blocco di SQL Slammer
Router(config-ext-nacl)#deny udp any any eq 1434
Router(config-ext-nacl)#deny tcp any any eq 1433
blocco di w32.blaster
Router(config-ext-nacl)#deny tcp any any eq 135
Router(config-ext-nacl)#deny udp any any eq 135
Router(config-ext-nacl)#deny udp any any range 137 139
Router(config-ext-nacl)#deny tcp any any eq 139
Router(config-ext-nacl)#deny tcp any any eq 445
Router(config-ext-nacl)#deny tcp any any eq 593
Router(config-ext-nacl)#deny tcp any any eq 4444
ecc ecc ecc
Ciao
Don
------------------------
http://www.ciscoshop.it