sh access-list Extended IP access list 101 deny tcp any eq 137 any deny tcp any eq 138 any deny tcp any eq 139 any (699 matches) deny udp any eq netbios-ns any (4869 matches) deny udp any eq netbios-dgm any (5580 matches) deny udp any eq netbios-ss any permit ip any any (257898 matches) permit tcp host 172.25.7.1 eq 137 any permit tcp host 172.25.7.1 eq 138 any permit tcp host 172.25.7.1 eq 139 any permit udp host 172.25.7.1 eq netbios-ns any permit udp host 172.25.7.1 eq netbios-dgm any permit udp host 172.25.7.1 eq netbios-ss any Extended IP access list 111 permit ip any any

Looks to me like you are working in reverse. I would leave an explicit deny any any at the end and only permit what is required.

Two things: 1) This belongs in the networking forum, where I notice you DID also post it. 2) I already answered it there. Go look at it. Oh, and this wasn't much of a challenge. Give me a real challenge, and maybe I'll have to think about the solution. :) Cheers Chase