Home / server / Questions / 336692
Accepted
MatBanik
Asked: 2011-12-02 08:30:26 +0800 CST

Is it possible to load access-list on Cisco Router with BGP or SNMP?

  • 772

I was wondering if there is any Cisco product that supports import of external list with IP ranges to be blocked or allowed.

CIRD format:

# List distributed by ...

123.15.49.0/24
60.166.28.0/24
114.36.130.0/24
195.56.150.0/24
212.117.177.0/24
89.242.30.0/24
87.106.3.0/24
61.235.46.0/24
210.112.12.0/24

The updates would be daily.

cisco

2 Answers

  1. Best Answer

    In what form would this list be supplied, and how often would you want to update it? You could set up a cron job that copies over an access-list on a daily basis, or you could set up a BGP peer with a quagga server to feed it a list of routes, but you're not likely to find a button that says 'block these IPs'.

    • 2

  2. Based on on @Aaron's answered this is what I came up with:

    conf t
int f0/0
no ip access-group 101 in
exit
no access-list 101
exit
copy ftp://192.168.1.100/access-list-101.txt running-config 
running-config
conf t
int f0/0
ip access-group 101 in
exit 
exit
conf t 
service compress-config 
exit
wri mem

    And here is how you can use kron:

    http://www.cisco.com/en/US/docs/ios/12_3/feature/guide/g_kron.html

    And here is little java hint on how do the conversion:

    https://stackoverflow.com/q/8347908/465179

    • 0