1

On Cisco devices I'm looking to enable some filtering for one specific vlan (id 110).

Here is my config : (192.33.57.177 is the DHCP server host)

ip access-list extended VLAN110-DHCP
 permit ip any host 192.33.57.177
 permit ip host 192.33.57.177 any
 permit ip any host 192.33.57.7
 permit ip host 192.33.57.7 any
ip access-list extended VLAN110-RFC
 permit ip any 192.168.0.0 0.0.255.255
 permit ip 192.168.0.0 0.0.255.255 any
 permit ip any 172.16.0.0 0.15.255.255
 permit ip 172.16.0.0 0.15.255.255 any
 permit ip any 10.0.0.0 0.255.255.255
 permit ip 10.0.0.0 0.255.255.255 any

vlan access-map VMAP-VLAN110 5
 match ip address VLAN110-DHCP
 action forward
vlan access-map VMAP-VLAN110 10
 match ip address VLAN110-RFC
 action drop
vlan access-map VMAP-VLAN110 20
 action forward

vlan filter VMAP-VLAN110 vlan-list 110

Yet when I get a device in VLAN110 I have no connectivity at all... I want to have connectivity only to DHCP server and public IPs. I want to filter private IPs. Is there anything missing to my configuration ?

Thanks

Improve this question
2
  • Is vlan110 inside RFC1918 address space? Are your DNS servers inside RFC1918 address space? Do you have connectivity without the VACL applied?
    – Darrell Root
    Aug 5, 2020 at 8:51
  • I have connectivity without the VACL applied. vlan 110 is inside RFC1918. should i just add an exception for vlan 110 address space as well ?
    – Jeremy G.
    Aug 5, 2020 at 9:20

1 Answer 1

Reset to default
5

Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it.

The first thing you need to do is figure out exactly what you want your access-map to do. Here's what I think you want:

  1. Permit traffic between your (RFC1918) subnet and internet-routable space (including the DHCP server)
  2. Deny traffic between your RFC1918 subnet to other RFC1918 space, including within the vlan.

I will assume this is an access subnet/vlan, and not a transit subnet/vlan. So I only need to block traffic to or from the subnet assigned to the vlan.

Lets assume your vlan110 subnet is 192.168.1.0/24.

ip access-list extended vlan110-rfc1918
permit 192.168.1.0 0.0.0.255 10.0.0.0 0.255.255.255
permit 192.168.1.0 0.0.0.255 172.16.0.0 0.15.255.255
permit 192.168.1.0 0.0.0.255 192.168.0.0 0.0.255.255
permit 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255
permit 172.16.0.0 0.15.255.255 192.168.1.0 0.0.0.255
permit 192.168.0.0 0.0.255.255 192.168.1.0 0.0.0.255

vlan access-map VMAP-VLAN110 10
 match ip address vlan110-rfc
 action drop
vlan access-map VLAN-VLAN110 20
 action forward

One issue you may run into is an inability to communicate between the default gateway and the hosts in your subnet. That could affect services such as DHCP renewals with ip helper enabled.

If you are trying to just block intra-vlan communication inside your vlan, then your ACL becomes much simpler. Again assuming vlan110 is 192.168.1.0/24

ip access-list extended vlan110-intra-vlan
permit 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255

vlan access-map VMAP-VLAN110 10
 match ip address vlan110-intra-vlan
 action drop
vlan access-map VLAN0VLAN110 20
 action forward

I personally prefer to avoid using VACLs. I put most of my ACLs on router layer-3 interfaces, and only use VACLs for blocking intra-vlan traffic. VACLs are hard to maintain and debug.

Improve this answer
2
  • What I'm trying to do is permit traffic between my RFC1918 subnet and internet-routable space. But also permit traffic between my RFC1918 subnet and a few internal resources, as well as allow intra vlan communication. So I'm thinking I need to add permit 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255 with an action forward on the VACL?
    – Jeremy G.
    Aug 5, 2020 at 20:09
  • @JeremyG. If you want to allow intra-vlan traffic, I would implement the security policy as a layer-3 ACL on the first-hop router. That way intra-vlan traffic does not even get evaluated against the acl. If you insist on a vacl, then you need a permit-deny-permit access map: 1) permit intra-vlan traffic (as you suggested), 2) deny between subnet and rfc1918 (as above), 3) permit (as above)
    – Darrell Root
    Aug 5, 2020 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.