5

i am trying to setup ACL on my core router, i have the following networks:

  • Data (192.168.32.0/24)
  • Voice (192.168.42.0/24)
  • Guest (192.168.100.0/24)
  • QA (192.168.101.0/24)

I would like the following traffic flow:

  1. Voice to internet and data only
  2. Guest to internet only (no possibility of any local network)
  3. Data to voice, internet and initiate connections to QA
  4. QA to internet and respond to initiated connections from data (no possibility of making new connections to any local network)

I have the following ACL:

ip access-list extended guest-in
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 255.255.0.0
 permit ip any any

ip access-list extended guest-out
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 255.255.0.0
 permit ip any any

ip access-list extended qa-in
 // how to please allow tracked connections initiated from user to QA?
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 255.255.0.0
 permit ip any any

ip access-list extended user-out
 allow ip any 192.168.101.0 0.0.0.255
 deny ip any 192.168.100.0 0.0.255.255
 permit ip any any

Is there any simpler way to do the above, and how would i allow tracked connections to be initiated from data to QA allowed (but not QA to initiate connections to data)?

  • "how would i allow tracked connections to be initiated from data to QA allowed (but not QA to initiate connections to data)?" Look up reflexive access list. – Ron Maupin Jul 10 '18 at 15:31
  • Also, you really do not need both in and out, but if you do, the addresses must be reversed (source and destination) in the ACLs. Normally, extended ACLs are placed as close to the source as possible, so they would be inbound on the router interface. – Ron Maupin Jul 10 '18 at 15:35
  • I would also question your requirement that voice VLANs need to access the Inernet. – Ron Trunk Jul 30 '18 at 16:51
3

As a side note, on your Guest and QA ACLs, you're using wildcard masks for your first 2 ACEs but a subnet mask for your third (172.16.0.0 255.255.0.0). It's also wrong, as is. 172.16.0.0 (as is defined in RFC 1918) is a /12 network, so your mask should either be 255.240.0.0 (subnet mask) or 0.15.255.255 (wildcard mask). Whichever it's EXPECTING is what decided which you use. You need to use the ? command to see what it's expecting. None of the devices that I know of will stop you from entering whatever you want in an ACL, even if it's wrong. You could literally type a mask of 222.222.222.0 and it would accept it.

2

If you are using a newer Cisco router I would check out zone-based firewalling to solve your Data to QA problem. Traditional ACLs are stateless so they do not remember any connection states. With ZBF the zones are stateful so return traffic initiated from Data to QA are allowed, while blocking traffic initiated from QA to Data.

Here is Cisco's design guide on Zone based firewalling: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.