1

Pleasae I am facing this problem, the ping is always successful from 10.16.13.2 to 192.168.0.3

even if Iam configuring the acl in the 'in indirection'.

show ip access-list

  Extended IP access list wifi

  10 deny ip 10.16.13.0 0.0.0.255 192.168.0.0 0.0.0.255

  20 permit ip any any (2 matches)

sh int vlan 13

 interface Vlan13

 ip address 10.16.13.254 255.255.255.0

 ip access-group wifi in
10
  • Have you made sure that the denied traffic is running through VLAN 13? Have you tried applying the ACL to the interface facing the WAP?
    – Zac67
    Oct 29, 2023 at 10:05
  • Yes, I am applying the acl to int vlan 13 as shown and have also specified the exact subnet for this vlan 10.16.13.0 in the acl.
    – Asma B
    Oct 29, 2023 at 12:30
  • When you run the ping does the number of matches in "permit ip any any" increase? If not, then this ACL doesn't apply to this traffic
    – manish ma
    Oct 29, 2023 at 13:01
  • yes,exactly it increases in the permit ip any any
    – Asma B
    Oct 29, 2023 at 13:22
  • Extended IP access list wifi 10 deny ip 10.16.13.0 0.0.0.255 192.168.0.0 0.0.0.255 20 permit ip any any (6 matches)
    – Asma B
    Oct 29, 2023 at 13:32

1 Answer 1

2

I can confirm that the ACL is functioning as expected. Initially, I attempted to ping from the IP address of the Interface VLAN 13 (the gatway of this vlan 13) which means the ping was generated directly from the multilayer switch. However, I realized that the ACL's purpose is to filter traffic that passes through it, not the traffic generated by the device itself. This explains why the pings were not affected by the ACL. Thank you for your help and support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.