0

So i'm configuring a basic network and I need to create a couple of Extended ACLs. Now my question is, does this ACE permit any TCP connection to the following subnet?

permit tcp 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

Basically, what i'm trying to achieve is that I want the 192.168.10.0 subnet to permit any tcp to the 192.168.20.0 subnet. Is it correct? OR should I switch to a standard ACL?

Thanks, Matthew

  • That's correct. Is there a reason why you think it's not? – Jesse P. Feb 21 at 15:44
  • 1
    You need to apply the ACL to an interface, too, if you've not done that part. You can apply it on either the source or destination side, depending on the direction you want to apply the ACL in (as traffic leaves the source, or as traffic enters the destination). – Jesse P. Feb 21 at 15:46
  • If you need help applying the ACL to an interface, you will need to provide a sanitized configuration of your device and tell us which side/direction you want to apply it in. – Jesse P. Feb 21 at 16:14
2

permit tcp 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 allows (any) TCP segments to travel from 192.168.10.0/24 to 192.168.20.0/24.

Depending on which interfaces you apply this ACE and which directions the packets travel you might also need to permit the opposite direction (esp. when applying to a VLAN and not a physical port/LAG trunk) - ACLs are stateless unlike many firewall rules which imply traffic in the opposite direction.

Also, note that ACLs have an implied deny ip any any as their last ACE. If the permission above isn't the only traffic you want to permit (UDP? ICMP? ...) you'd need to add more ACEs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy