[cisco-voip] ACL to block SIP on a specific interface

[Joseph Mays]

We have an AS5400 with some voip customers down it. SIP traffic, and other kinds of traffic, passing through is fine, but we have had a spate of queries from the world hitting the ethernet interface (ip address x.x.8.10) of the AS5400 with SIP queries, probably feelers looking for open sip ports. I want an ACL that will specifically block sip requests to this interface while allowing everything else through.



I was going to put in the following ACL --


ip access-list extended block-world-sip
deny ip any host x.x.8.10 eq 5060 log-input
permit ip any any

And put the following on the interface --

ip access-group block-world-sip in

I think this should accomplish the goal, but I wanted to ask first if there is a better way of doing this.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20130801/caf34faa/attachment.html>