How to Configure ACL in subinterfaces

Question

"Guys, I am having trouble configuring a Cisco network. I have a router with three configured sub-interfaces."

interface GigabitEthernet0/1
ip address 20.0.0.1 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/1.20
encapsulation dot1Q 20
ip address 100.20.20.1 255.255.255.0
ip access-group PERMIT-20-TO-30 out
!
interface GigabitEthernet0/1.30
encapsulation dot1Q 30
ip address 100.30.30.1 255.255.255.0
ip access-group DENY-30-TO-20 in
!
interface GigabitEthernet0/1.40
encapsulation dot1Q 40
ip address 100.40.40.1 255.255.255.0
!

"My router is configured to distribute DHCP on each sub-interface according to its ID:"

ip dhcp excluded-address 100.20.20.1 100.20.20.10
ip dhcp excluded-address 100.30.30.1 100.30.30.10
ip dhcp excluded-address 100.40.40.1 100.40.40.10
!
ip dhcp pool SITE_A
network 100.20.20.0 255.255.255.0
default-router 20.0.0.1
dns-server 8.8.8.8
ip dhcp pool SITE_B
network 100.30.30.0 255.255.255.0
default-router 20.0.0.1
dns-server 8.8.8.8
ip dhcp pool SITE_C
network 100.40.40.0 255.255.255.0
default-router 20.0.0.1
dns-server 8.8.8.8

"I am trying to allow users on the GigabitEthernet0/1.20 sub-interface to access the GigabitEthernet0/1.30 interface without restrictions. However, I want the GigabitEthernet0/1.30 interface to not be able to access the GigabitEthernet0/1.20 interface. I am trying to do this with ACLs. I created the ACL rules:"

ip access-list extended PERMIT-20-TO-30
permit ip 100.20.20.0 0.0.0.255 100.30.30.0 0.0.0.255
permit ip any any
ip access-list extended DENY-30-TO-20
deny ip 100.30.30.0 0.0.0.255 100.20.20.0 0.0.0.255
permit ip any any

"And I applied them to the respective interfaces:"

interface GigabitEthernet0/1.20
encapsulation dot1Q 20
ip address 100.20.20.1 255.255.255.0
ip access-group PERMIT-20-TO-30 out
!
interface GigabitEthernet0/1.20
encapsulation dot1Q 20
ip address 100.20.20.1 255.255.255.0
ip access-group PERMIT-20-TO-30 out
!

"After applying the ACLs, the interfaces are not communicating at all. But I want GigabitEthernet0/1.20 to access the GigabitEthernet0/1.30 interface without restrictions. I've been struggling with this for 2 days. Is there something wrong?"

Answer 1

ACL issues

First off, the PERMIT-20-TO-30 ACL permits all traffic. It is actually equivalent to the following:

ip access-list extended PERMIT-20-TO-30
  permit ip any any

What is an interface and an IP subnet

Your requirements seem to be:

• allow users on the GigabitEthernet0/1.20 sub-interface to access the GigabitEthernet0/1.30 interface
• the GigabitEthernet0/1.30 interface to not be able to access the GigabitEthernet0/1.20 interface

When you say "to access the X interface", you must understand that the X interface is essentially a single IP address. When you say "the Y interface to not be able to..." then again this means you want to control what a single IP address can or cannot do.

When you say "allow users on the GigabitEthernet0/1.20 sub-interface", what this essentially translates to is "VLAN 20", where VLAN 20 is the 100.20.20.1/24 subnet.

With the above clarifications, we can now re-write your requirements as:

• allow traffic from 100.20.20.0/24 (VLAN 20) to 100.30.30.1 (the GigabitEthernet0/1.30 interface)
• deny traffic from 10.30.30.1 (the GigabitEthernet0/1.30 interface) to 100.20.20.1 (the GigabitEthernet0/1.20 interface)

From the ACLs you have provided, I assume you also need all other traffic to be permitted. So, one last requirement:

• all other traffic should be permitted

ACL to meet the question's (re-written) requirements

The ACL to meet the above requirements is:

ip access-list extended ACL-ATTEMPT-1
  deny ip host 100.30.30.1 host 100.20.20.1
  permit ip any any

Since the above is an ACL that meets exactly your requirements, you can (and should) apply it in and out of all interfaces on your network.

Re-write requirements to be closer to what you actually need

At this point, I will assume that this is not what you need.

Let's re-write your requirements into something that make more sense and is likely closer to what you actually meant:

• allow traffic from 100.20.20.0/24 (VLAN 20) to 100.30.30.0/24 (VLAN 30)
• deny traffic from 100.30.30.0/24 (VLAN 30) to 100.20.20.0/24 (VLAN 20)
• all other traffic should be permitted

Now imagine I have a magic wand and managed to apply the above logic onto your entire network. Never mind the ACLs and interfaces, and directions.

What you will get is traffic from VLAN 20 going to VLAN 30, but the return traffic will not go through. Imagine host H20 (with IP address 100.20.20.20) pinging host H30 (with IP address 100.30.30.30). The ICMP Echo request will leave H20 and manage to reach H30. But the ICMP Echo reply that host H30 tries to send back to H20 is not allowed to return back to H30. So, even though 1-way traffic is actually allowed and does go through, you cannot verify this with a simple ping.

One last attempt

But, assuming that this is what you need, the following ACL will meet the new re-written requirements:

ip access-list extended ACL-ATTEMPT-2
  deny ip 100.30.30.0 0.0.0.255 100.20.20.0 0.0.0.255
  permit ip any any

And since this ACL applies the business intent, you can actually apply it everywhere:

interface GigabitEthernet0/1.20
  ip access-group ACL-ATTEMPT-2 in
  ip access-group ACL-ATTEMPT-2 out
!
interface GigabitEthernet0/1.30
  ip access-group ACL-ATTEMPT-2 in
  ip access-group ACL-ATTEMPT-2 out

If you are not paranoid, you actually only need to apply it inbound on the .30 or outbound on the .20 interface. Both of the following are equivalent:

interface GigabitEthernet0/1.20
  ip access-group ACL-ATTEMPT-2 out

Or (a little better):

interface GigabitEthernet0/1.30
  ip access-group ACL-ATTEMPT-2 in