1

I am trying to optimize the access control list rules on a Cisco SG500X-48 Small Business switch (on Layer 3). The general aim is to regulate the traffic between two VLANs (e.g., 10 and 30) in such a way that VLAN 30 has access to VLAN 10, but only for specific protocols, while VLAN 10 has no access at all to VLAN 30.

Thus far I have configured the switch only for ICMP and HTTP as an initial test, like this:

Extended IP access list VLAN 10 Test 1

permit  icmp 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 10 type echo-reply code any
permit  tcp 192.168.30.0 0.0.0.255 any 192.168.10.0 0.0.0.255 www ace-priority 20
permit  tcp 192.168.10.0 0.0.0.255 www 192.168.30.0 0.0.0.255 any ace-priority 21
deny    ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 100

and applied this as an ingress ACL with an explicit "permit" to VLAN 10. As a result:

  • VLAN 30 can ping VLAN 10
  • VLAN 30 can access VLAN 10 on HTTP (but cannot access any other service in VLAN 10)
  • VLAN 10 has no access to VLAN 30 whatsoever

So far, so good. However, as I need to configure such ACL entries for multiple protocols on multiple VLANs, I wondered if I couldn´t minimize the required entries by first allowing the requests from VLAN 30 to VLAN 10 from TCP any to any port:

permit tcp 192.168.30.0 0.0.0.255 any 192.168.10.0 0.0.0.255 any ace-priority 20

and then permitting the replies from VLAN 10 only for the ports corresponding to the services that I wish to allow to respond to the requests:

permit tcp 192.168.10.0 0.0.0.255 www 192.168.30.0 0.0.0.255 any ace-priority 21

permit tcp 192.168.10.0 0.0.0.255 telnet 192.168.30.0 0.0.0.255 any ace-priority 22

permit tcp 192.168.10.0 0.0.0.255 ssh 192.168.30.0 0.0.0.255 any ace-priority 23

Unfortunately, this doesn´t seem to work, as when I configured and applied to VLAN 10 the following ACL on the switch:

Extended IP access list VLAN 10 Test 2

permit  icmp 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 10 type echo-reply code any
permit  tcp 192.168.30.0 0.0.0.255 any 192.168.10.0 0.0.0.255 any ace-priority 20
permit  tcp 192.168.10.0 0.0.0.255 www 192.168.30.0 0.0.0.255 any ace-priority 21
deny    ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 100

VLAN 30 lost access to VLAN 10 on HTTP. On the contrary, and for a reason as of yet inexplicable to me, VLAN 10 suddenly was able to access VLAN 30 on HTTP, which of course shouldn´t happen.

I searched the web for a deeper explanation of how ACL rules work, but was unable to find anything explaining this behaviour. I guess I might be missing something fundamental. Could you please enlighten me?

Thank you in advance for your time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.