background image
144 Chapter 6: Using ISDN and DDR Technologies
Specifying Interesting Traffic with Access Lists
Example 6-4 and 6-5 deal with a blanket statement enabling entire protocol suites. This type of
implementation is not always the best, or preferred, method of defining interesting traffic.
To define specific traffic types as interesting traffic, you should use access lists. Any type of
access list can be implemented in defining interesting traffic. Rather than being associated with
an interface, the access list is associated with the dialer-list.
This access list discussion focuses on IP access lists because the author assumes that you are
already familiar with access lists to some degree.
Example 6-6 shows a sample configuration using IP extended access lists to define interesting
traffic. The explanation follows the output.
Example 6-6 implements a more specific definition of interesting traffic. access-list 101 is
denying FTP and Telnet. That is, they are not allowed to trigger a call setup. Any other IP traffic
attempting to traverse the link triggers the call. Once the call is up, Telnet and FTP can go across
freely.
Notice the dialer-list line highlighted in Example 6-6. Rather than enabling the entire IP
protocol suite to trigger the call, this line specifies that all traffic attempting to exit through BRI
0 must be tested against access-list 101.
The interface configuration has not changed from our basic configuration model. Only the
dialer-list has been altered to point to the access list. The dialer-list still must point to the dialer-
group on the interface (that is, the dialer-list and dialer-group numbers must match). The access
list number can be any valid standard or extended access list number (Example 6-6
demonstrates IP only). However, as stated earlier, interesting traffic for any protocol can be
implemented using the appropriate access list command structure.
Example 6-6
Extended Access Lists with Interesting Traffic
RouterA#config t
RouterA(config)#access-list 101 deny tcp any any eq ftp
RouterA(config)#access-list 101 deny tcp any any eq telnet
RouterA(config)#access-list 101 permit ip any any
!
RouterA(config)#interface bri 0
RouterA(config-if)#ip address 10.12.1.1 255.255.255.0
RouterA(config-if)#encapsulation ppp
<output omitted>
RouterA(config-if)#dialer-group 2
!
RouterA(config)#dialer-list 2 protocol ip list 101