I have written ACL rules written for a Dell PowerConnect 8024F (which, for the most part, uses the Cisco ACL "language") to isolate WiFi traffic from the rest of the network but allow the traffic on VLANs to access internet traffic.
That is to say, the ACL rules allow traffic from a VLAN carrying WIFI traffic to a Transit VLAN whose other endpoint is a firewall interface, but disallows any ingress/egress traffic from that VLAN (i.e. I am trying to forbid "cross-talk" between wireless and wired traffic, if that makes sense).
What I have so far works, but the future problem I am observing is that the current rules I have are ending in "permit all" rule instead of "deny all" rule - and are thus scaling poorly, as I have to amend a bunch of ACL for each new VLAN that I am adding. The added workload is not so much the problem - it's the fragility/forgetfulness of the mind; it feels...wrong to have to do this and I am almost sure there is better way. Unfortunately, I have not found a better way and would definitely like to do that.
Just to make it a slightly less informal - assume four VLANs:
- A and B => wired VLAN traffic (VLAN 10/20 - IP range 10.0.10.0/24 and 10.0.20.0/24)
- W => wireless VLAN traffic (VLAN 240 - IP range 10.0.240.0/24)
- T => transit VLAN traffic (VLAN 300 - IP range 172.16.0.0/29)
I'd like write a set of rules such that traffic:
- A <-> W => denied
- A <-> T => permitted
- B <-> W => denied
- B <-> T => permitted
- W <-> T => permitted
( <->
meaning traffic flowing both ways)
Rules I've initially written were written like so:
- A)
access-list secure_wifi permit ip 10.0.240.0 0.0.0.255 172.16.0.0 0.0.0.7
(meaning: "allow wireless traffic to transit vlan") - B)
access-list secure_wifi permit ip 172.16.0.0 0.0.0.7 10.0.240.0 0.0.0.255
(meaning: "allow transit vlan traffic to wireless vlan") - C)
access-list secure_wifi permit ip 0.0.0.0 127.255.255.255 172.16.0.0 0.0.0.7
(meaning: "allow traffic to WAN traversing transit vlan")
This is all I think I should have but applying these gives me tracert
timeout after the VLAN and no internet traffic.
I've tried many different combinations of these rules as both inbound and outbound rules (and mixes between the two) but I never really got it to work properly. The best I have done was to make tracert
hop to transit VLAN and then mysteriously timeout. I have also found myself confused with "what traffic is inbound or outbound to a given port?".
Instead, what I ended up doing is something like this (these are bound as port inbound ACL):
access-list secure_wifi deny ip 10.0.10.0 0.0.0.255 10.0.240.0 0.0.0.255
access-list secure_wifi deny ip 10.0.240.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list secure_wifi deny ip 10.0.15.0 0.0.0.255 10.0.240.0 0.0.0.255
access-list secure_wifi deny ip 10.0.240.0 0.0.0.255 10.0.15.0 0.0.0.255
access-list secure_wifi deny ip 10.0.20.0 0.0.0.255 10.0.240.0 0.0.0.255
access-list secure_wifi deny ip 10.0.240.0 0.0.0.255 10.0.20.0 0.0.0.255
access-list secure_wifi deny ip 10.0.30.0 0.0.0.255 10.0.240.0 0.0.0.255
access-list secure_wifi deny ip 10.0.240.0 0.0.0.255 10.0.30.0 0.0.0.255
access-list secure_wifi permit any any
What piece of knowledge am I lacking? How can I write these rules more simply and maintainably?
EDIT: fixed a typo and added a "C)" rule that I had tried, somewhat in desperation.