2

I have been looking around and it seems list this would be a simple question so I am sorry if there is a duplicate somewhere.

I have a switch that is carrying a vlan 20 which is holding a /24 .

the network is 10.10.0.1 /24

ip access-list extended jimmys_wireless
 deny   ip any 10.11.0.0 0.0.0.255
 deny   ip any 10.12.0.0 0.0.0.255
 deny   ip any 172.16.1.0 0.0.0.255
 permit ip any any

I have tried doing something like 

ip access-list extended jimmys_wireless
 permit ip any 10.10.0.0 0.0.0.255
 permit ip any 10.10.0.1 0.0.0.255 # default gateway
 deny ip any any

I get an ip but cannot get out to the internet at all. this network should only have access to internet and its own network. I want this because if I change the network or add anything, I wound have to update the blacklist to deny it.

Edit I have this set this for in . I think I tried this for in and I couldn't get an IP.

Improve this question
2
  • could you check your NAT/PAT? ISP drops the private IP address, maybe that's why you can not access the internet.
    – R-jay Remudaro
    Feb 23, 2016 at 21:07
  • I think this is unlikely the issue, do you have a better suggestion for the ACLs apart from checking my ISP? I would think if these problems existed, then I would suffer from this regardless of the ACL.
    – LUser
    Feb 24, 2016 at 4:22

2 Answers 2

Reset to default
1

The ACL you're setting up has to be applied to the VLAN interface as incoming, and should simply look like this: 

ip access-list extended jimmys_wireless
 /*permits here*/
 deny ip any 10.0.0.0 0.0.0.255
 deny ip any 172.16.0.0 0.15.255.255
 deny ip any 192.168.0.0 0.0.255.255
 permit ip any any

This way, all local addresses are banned, all public addresses (a.k.a. "The Internet") are allowed. You don't need to allow the gateway IP address, as it is just used to relay traffic for Internet IPs. But, as it won't be the destination IP of any IP packet, it doesn't need to be allowed in your ACL.

Improve this answer
3
  • 1
    There is nothing allowed (no permit statements) in this ACL. The deny ip any any on the last line is gratuitous since it is inherent in any ACL.
    – Ron Maupin ♦
    Feb 18, 2016 at 21:55
  • 1
    OK. you fixed that problem, but your wildcard masks are incorrect. It is still would not be a whitelist solution, which would be permit statements followed by the deny all.
    – Ron Maupin ♦
    Feb 18, 2016 at 22:02
  • Thanks again. I worked too many ASAs in the last time, so I forgot about the wildcard masks so common on Ciscos :-/ And yes, you're also right on the whitelist solution - it would just make no sense in this case.
    – xpac
    Feb 18, 2016 at 22:08
0

You need to look at whether it's applied inbound or outbound (you didn't specify), and the source and destination on each line. It's also important on which interface (you didn't specify) you apply the ACL.

You need to think it through and select the correct interface, correct direction, and the correct source and destination for what you want to do.

A better explanation would help us to help you.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.