3

I have following setup

Vlan10

Pc1 192.168.10.20

Vlan20

Pc2 192.168.20.20

Vlan21

Pc2 192.168.21.20

Subnet :255.255.255.0

All connected to layer 3 switch

I have following ACL

Access-list 10 permit 192.168.10.0 0.0.0.255

Access-list 20 permit 192.168.20.0 0.0.0.255

I applied the ACL to vlan 10 as below:

Interface vlan 10
IP access-group 20 in 

Why isn't it not possible to ping from vlan20 device to vlan 10 device ?

I even tried adding

Interface vlan 10
IP access-group 10 out

but it's not working

But if I try

Interface vlan 10
IP access-group 20 out, 

things works fine

If , standard access list checks source address , then we should be using inbound interface right ? But why isn't it working

Could anyone help me with this confusion

Thanks a lot in advance

  • Please add the entire ACLs to your question. If those lines are the full ACLs you've forgotten to permit the reply direction. Also, you'll want to apply ACLs to ingress traffic wherever possible to avoid dropping packets after processing. – Zac67 Nov 7 '18 at 16:36
  • @Zac67 how to do that and could you explain it in a simple way . I am really getting confused with the inbound and outbound terminology and source address in this case – PDHide Nov 8 '18 at 15:13
  • By using Access-list 10 permit 192.168.10.0 0.0.0.255 on a VLAN inbound you only permit packets originating from 192.168.10.0/24 into the VLAN, everything else is dropped (there's an implicit deny any at the end of each ACL). 'Inbound' means the packets are matched to the ACL when they enter the VLAN (through an interface or internal routing). 'Outbound' is the opposite, when they try to leave the VLAN - usually the 'inbound' approach is the better and more logical one. – Zac67 Nov 8 '18 at 18:00
  • i have added ACL 20 to vlan in interface 10 , but still i cant ping it from 192.168.20.x. when i ping from vlan 20 , the source is is 192.168.20.x so it should be pingable right . Its hard for me to understand sorry for so many questions . Really appreciate the time and help – PDHide Nov 8 '18 at 23:19
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:57
3

Standard access lists filter on source addresses. So ACL 20 only allows packets whose source IP is 192.168.20.x. But Vlan 10 is a different subnet, so any packet from VLAN 10 is dropped.

When you put the ACL in the outbound direction, then packet are coming from VLAN 20, and the packets are allowed.

  • so you are saying that , if i put ACL 20 on outbound interface of VLAN 10 . THen the interface allows only data coming from VLAN 20 ? . SO outbound means coming into the interface ? . What happens when i give VLAN 20 to inbound interface ? – PDHide Nov 8 '18 at 15:15
  • In and out are from the perspective of the router. So IN means entering the interface, and Out means leaving the interface. As I said, the ACL filters on the source address, so if you put ACL 20 inbound on VL 10, it will only allow packets whose source address matches the ACL. So you effectively block everything. – Ron Trunk Nov 8 '18 at 15:52
  • so if i keep ACL 20 to vlan interface inbound , it should allow all packets rom vlan 20 network right ? . WHy is it not pinging ?. When i give ACL 20 to outbound interface of vlan 10, things work fine . But if outbound is data going out , then source address will be 192.168.10.x , it will never be 192.168.20.x , so it shouldn't work. Please help i am really confused to understand this – PDHide Nov 8 '18 at 16:00
  • ACL 20 only allows packets whose source address is 192.168.20.x. You put it inbound in int VL 10. Now, when you ping from VL 20 to VL 10, the source address of the reply packet is 192.168.10.x and the destination address is 192.168.20.x. As the packet enters int VL 10, it filters using ACL 20. Since the packet has a source address of 192.168.10.x, it does not match ACL 20, and it is dropped. – Ron Trunk Nov 8 '18 at 16:26
  • why is it filtering outbound traffic when the ACL is applied only for inbound traffic? and when i gave ACL 20 to outbound the reply packet still has 192.168.10.x as source , but why is it working ? even this case it should filter the reply packet – PDHide Nov 8 '18 at 17:02
0

Thanks everyone I got the difference

For all standard ACL , there is an default deny ACE

ACE means the ACL entry:

 access-list 12 permit/deny x.x.x.x x.x.x.x'

Default ACE:  if a packet doesn't match any of the ACE in the ACL , then it is automatically blocked 

So if you want to allow only packets from VLAN 12 ( 192.168.12.0 ) to VLAN 10

U have to create ACE

Access-list 12 permit 192.168.12.0 0.0.0.255

And apply it to VLAN 10 outbound interface ,

Here we choose out bound as the packet is coming in from VLAN 12 and out to VLAN 10

ACL will check for packets coming into VLAN 10 from VLAN 12

So outbound = coming into the VLAN 10
(coming **out to** VLAN 10 **from** any other network )

here we don't want to create ACE to deny all other packets as cisco implements deny any by default

if we would have applied ACL 12 to inbound interface of VLAN 10 then ,

ACL will check for packets coming from VLAN 10 into VLAN 12 , and will reject everything which doesn't match the ACE. As there is no packet with source address 192.168.12.x (all packets from have source 192.168.10.x) , none of the packet will match the ACE. So all packets from VLAN 10 will be discarded and hence VLAN 10 can't communicate with any other network.

If you add ACE permit any , then it will first check the first condition and it doesn't pass, so it will check below condition . As we gave ACe as permit any, all packets will be allowed and there won't be any filtering

ACE: access-list 12 permit any

So in inbound interface ACL will check for packets coming from VLAN 10 to other networks

Hence inbound = coming from the VLAN 10
(coming **in from** VLAN 10 **into** any other network )

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.