3

I'm encountering some unexpected behavior when trying to reference object-groups in an access-list on my Catalyst 4500.

Goal: Restrict a VLAN from accessing other privately addressed subnets (Internet access only), except for a local DNS server in another subnet

IOS-XE Version: 03.03.00.XO RELEASE SOFTWARE (fc2)

General Config:

object-group network subnet_privateClassA 
 10.0.0.0 255.0.0.0
!
object-group network subnet_privateClassB 
 172.16.0.0 255.240.0.0
!
object-group network subnet_privateClassC 
 192.168.0.0 255.255.0.0
!
object-group network subnet_rfc1918All 
 group-object subnet_privateClassA
 group-object subnet_privateClassB
 group-object subnet_privateClassC
!
!

...

interface Vlan70
 ip address 10.10.70.254 255.255.255.0
 ip access-group publicVlan_in in
!

The following access-list blocks access to private IP ranges, except for the desired DNS server (10.16.4.10), but also blocks access to public IPs. So, DNS is able resolve google.com, but pings fail.

ip access-list extended publicVlan_in
 permit ip any host 10.32.4.10
 deny ip any object-group subnet_rfc1918All ! (I've also tried just subnet_privateClassA)
 permit ip any any
!

The next access list works exactly how I want - local DNS works and I can access the Internet:

ip access-list extended publicVlan_in
 permit ip any host 10.32.4.10
 deny   ip any 10.0.0.0 0.255.255.255
 deny   ip any 172.16.0.0 0.15.255.255
 deny   ip any 192.168.0.0 0.0.255.255
 permit ip any any
!

The problem seems to be the use of object-groups. What am I missing here?

|improve this question
  • I suspect a typo. Can you post the actual config? – Ron Trunk Mar 16 '15 at 22:07
  • show ip access-group publicVlan_in for both versions of the ACL – Ricky Beam Mar 16 '15 at 23:09
  • @Ron, I've updated my post with a copy/paste from my config. – Matthew Johnson Mar 17 '15 at 14:57
  • @RickyBeam - That access list is in production temporarily, so I can't update it to the non-working configuration just now. I did however examine the output of show ip access-list publicVlan_in (I'm assuming that's what you mean) while troubleshooting originally. I used pings to generate traffic, but the entry referencing the object-group didn't seem to be incrementing proportionally. I'm not sure what that means... – Matthew Johnson Mar 17 '15 at 15:11
  • If it doesn't appear to be automatically incrementing properly when using the object-group access list, have you tried manually incrementing each rule (10, 20, 30, etc) and then applying the newly created list? – Zack Scaringello Mar 17 '15 at 18:27
2

At long last, an answer. I recently encountered another situation where I had to create access-lists that would benefit from object-group references. After trying several different things to work around the problem, I finally threw in the towel and contacted Cisco technical support (which I'm always loath to do).

After an initial careless and blatantly wrong attempt to answer my question, the Cisco technician came back with the following:

Matthew,

I have reached out to the development team and object group configuration with the 4500 platform does not work as desired given the fact that the feature is not fully supported until code version 15.2(3)E2 which will be released around August 2015.

It is possible for the ACL to be configured because they have the same IOS XE base as other devices that support the feature at this time.

So, there you go - and it only took Cisco 6 days to come up with this answer (a record).

|improve this answer
-3

Use a policy routing instead. Two line to ACL deny any to inside DNS server then allow all else inside. Set the next hop to the ISP interface's IP address.

Example:

Router(config-route-map)# set ip next-hop ip-address [ip-address]

Specifies the next hop to which the packet will be routed, and the next hop must be an adjacent interface of the next router.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.