1

I am trying to create a access in a "router-on-a-stick" which only allow VLAN 62 to communicate with a server on another VLAN and no other hosts in the other VLANs can get to VLAN 62.To be clear, my VLAN 62 is a VLAN for webcams and my server is the registration server. I have try doing standard and extended acl but it just wouldn't work. Can anyone help me out ?
P.s: I have one question, too. In standard acl, is it true that the "deny part" have to be on top of the "permit part". Sorry for my bad English.

version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
ip dhcp pool 61
 network 192.168.6.64 255.255.255.192
 default-router 192.168.6.65
ip dhcp pool 62
 network 192.168.6.128 255.255.255.192
 default-router 192.168.6.129
ip dhcp pool 2
 network 192.168.6.0 255.255.255.192
 default-router 192.168.6.1
!
!
!
ip cef
no ipv6 cef
!
!
!
!
license udi pid CISCO1941/K9 sn FTX1524S9UZ
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.2
 encapsulation dot1Q 2
 ip address 192.168.6.1 255.255.255.192
!
interface GigabitEthernet0/0.61
 encapsulation dot1Q 61
 ip address 192.168.6.65 255.255.255.192
!
interface GigabitEthernet0/0.62  ! *** I want this VLAN to be completely separate from others except for VLAN 2 ***
 encapsulation dot1Q 62
 ip address 192.168.6.129 255.255.255.192
 ip access-group 162 in
 ip access-group 162 out
!
interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/1/0
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial0/1/1
 ip address 192.168.67.3 255.255.255.0
!
interface Vlan1
 no ip address
 shutdown
!
router rip
 network 192.168.6.0
 network 192.168.67.0
!
ip classless
!
ip flow-export version 9
!
!
access-list 162 permit ip 192.168.6.128 0.0.0.64 192.168.6.0 0.0.0.64
access-list 162 deny ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end
  • Can you please update your question with the configuration of the router? For ACL on Cisco, there is always an implicit deny ip any any rule at the end of it. And it depends on your requirements, so that we would know where to put deny or permit rules. – Hung Tran Nov 30 '17 at 16:11
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 20:21
2

Edited:

To allow devices on VLAN 62 to talk to VLAN2, and nothing else.

access-list 162 permit ip 192.168.6.128 0.0.0.63 192.168.6.0 0.0.0.63
access-list 162 permit udp any any eq bootps
access-list 163 permit ip 192.168.6.0 0.0.0.63 192.168.6.128 0.0.0.63
access-list 163 permit udp any any eq bootpc
interface GigabitEthernet0/0.62
ip access-group 162 in
ip access-group 163 out

Note the wildcard mask 0.0.0.63 in the ACLs. Also, "deny any any" is implicit at the end of every ACL. If you explicitly state it, it goes at the end.

  • I have come to another problem. VLAN 62 can't get to router to get a ip address – Dang Nguyen Nov 30 '17 at 23:39
  • The correct subnet ID is "192..." not "162...". – Hung Tran Nov 30 '17 at 23:39
  • Still not work... VLAN 62 still can't reach my router to get ip addesses. – Dang Nguyen Nov 30 '17 at 23:59
  • @DangNguyen Updated the ACLs – Ron Trunk Dec 1 '17 at 2:35
  • @RonTrunk The rule 'access-list 162 permit udp any any eq bootpc' does not work. Broadcasting DHCP request has destination UDP port 67 - bootps, not 68 - bootpc. UDP port 68 (bootpc) is source port. That is why clients cannot get IP addresses. – Hung Tran Dec 1 '17 at 18:58
1

I would assume that you want hosts in VLAN 62 to reach hosts in VLAN 2 (and vice versa) only, and nothing else (no Internet...):

access-list 162 permit ip 192.168.6.128 0.0.0.63 192.168.6.0 0.0.0.63
access-list 162 permit udp any any eq bootps
access-list 162 deny   ip any any log

access-list 163 permit ip 192.168.6.0 0.0.0.63 192.168.6.128 0.0.0.63
access-list 163 deny   ip any any log

interface FastEthernet0/0.62
 encapsulation dot1Q 62
 ip address 192.168.6.129 255.255.255.192
 ip access-group 162 in
 ip access-group 163 out

Notice that the rule access-list 162 permit udp any any eq bootps is for hosts in VLAN 62 to reach this Router (as DHCP server) to get DHCP IP addresses. In this setup, we do not need to mirror this rule in access-list 163.

Last but not least, the best practice is: always put an explicit deny ip any any rule with log option at the end of your ACL to verify what is blocked/denied. You then can modify the ACL accordingly.

I hope it is helpful and you can solve this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.