Hi i have Cisco switch model 2960 48 ports i plane to disable three ports on it for Internet service. I want to know how can apply the command on port number 20,21and 23 to close port number 80&443 .
asked Sep 16, 2017 at 15:10
-
You mean TCP ports 80 and 443 to the switch itself? The three ports are to be used as WAN ports? You'll need to set up a VLAN for these ports; you can't mix internal and external traffic.– Zac67 ♦Commented Sep 16, 2017 at 16:26
-
Yes ,And used for WAN .– Network_infrastructureCommented Sep 16, 2017 at 16:54
-
Ok I will set up a new valn for it there is a command to close these ports on the port itself???– Network_infrastructureCommented Sep 16, 2017 at 16:54
-
The management interfaces are bound to the IP address inside the default or the management VLAN. They can't be connected to from a VLAN with no IP address bound to.– Zac67 ♦Commented Sep 16, 2017 at 17:06
-
1@Network_infrastructure you are looking to use an ACL to do what you want. However, ACLs cannot be simply applied to a physical port on a 2960. It must be applied to a layer 3 boundary. This is a logical interface on a 2960. Without seeing a full configuration, the correct interface to which the ACL must be applied is impossible to know with any certainty. Also, the commands required to configure an ACL can vary by IOS and platform. A running configuration would help clarify any questions and allow us to provide better answers.– TDurdenCommented Sep 16, 2017 at 18:49
|
Show 4 more comments
3 Answers
As I understand, you want to block http/https traffic on switch ports 20,21 and 23 so that users cannot access any web pages (http/https), is it correct?
If yes, you can try to use Port ACLs. You would need an ACL and apply it to switch ports 20,21 and 23.
Let me assume the format of your switch port 20 is f0/20, the following configuration is an example of Port ACLs on switch port 20:
ip access-list extended block-http-https
deny tcp any any eq www
deny tcp any any eq 443
permit ip any any
interface FastEthernet0/20
switchport mode access
ip access-group block-http-https in
end
I hope it is helpful and answers your question.
A quite usual security practice is to have different VLAN's for different purposes.
And to place the switch management on the same VLAN as users, internet services is a bad practice if there isn't any special reasons for it.
Modification of Layer3 and above services is typically done at the gateway/router as switches do not read into frames. So, you would apply an access control list, ACL, at the gateway.
You would isolate out 'no-web' ports into a distinct VLAN then restrict for that VLAN's subnet.
answered Dec 17, 2017 at 20:49
