Questions tagged [access-control]
For questions about access control lists (ACLs). For instance, you want to limit network traffic to increase network performance or provide traffic flow control on your network device. ACLs also provide a basic level of security for network access by defining which part of the network/server/service can be accessed by a host and which cannot.
56
questions
0
votes
0
answers
14
views
How MACA will behave in this situations?
I am trying to understand how collisions are resolved in the MACA protocol when there are three stations - A, B, and C with the following reachability:
A can only communicate with B
B can communicate ...
0
votes
1
answer
151
views
How is the efficiency of Pure ALOHA derived using Poisson's Distribution?
Pure ALOHA has a vulnerable time of 2T where T is the transmission time for a single frame. Pure aloha has a maximum throughput of 18% but how is it actually derived from Poisson's distribution?
- 111
0
votes
1
answer
126
views
How to permit ospfv3 packet in ipv6 access list?
In Packet Tracer, I have a private network with 5 different VLANs and inter-vlan routing enabled on R1. These are connected via an edge router to an ISP. On the interface S0/0/0 of R1 in direction in ...
- 305
0
votes
1
answer
231
views
Why does this access list block DHCP request?
To prevent IP spoofing in a VLAN I configured the following access list
ip access-list extended MITARBEITER
permit tcp 10.15.240.0 0.0.0.255 any
permit udp 10.15.240.0 0.0.0.255 any
permit icmp 10....
- 305
1
vote
2
answers
58
views
Huawei Cloudengine 6851 ipv6 acl not matching
I have a Huawei 6851 and this is my config
acl ipv6 number 3006
description MY-IPv6
rule 10 permit ipv6 source 2001:x:x:x::x:x/112
rule 20 deny ipv6 destination 2001:x:x:x::x:y/128
rule 30 permit ipv6
...
- 577
6
votes
1
answer
348
views
Why do we need deny statements in extended access list if there is an implicit deny all at the end?
Can somebody give me an example, where deny statements are needed? Why can't we just permit all the traffic according to specifications and then let the implicit deny all capture the rest?
- 305
0
votes
1
answer
167
views
Why does the Throughput of Non-persistent CSMA increase with attempts made to send packets
Its intuitive for Aloha and p-persistent CSMA that the more we try to send during a packet time the more the collisions we get; however, I have been unable to justify why non-persistent CSMA is ...
- 105
0
votes
1
answer
422
views
Cisco router access list not working as expected
I'm trying to set up a network in packet tracer with inter-VLAN routing. I need to restrict one of the VLANs to only accept traffic from the 172.25.30.0/24 network.
To do this I am using an access ...
- 3
1
vote
2
answers
1k
views
How is P actually chosen in P-persistent CSMA?
I am struggling to understand how the probability value P is chosen for P-persistent CSMA for any particular station, what's the logic behind this.I have read from Wikipedia .
P-persistent
This ...
- 378
0
votes
1
answer
79
views
Is this a good network configuration?
I am trying to configure ip sla for non directed link . I have configured static route to reach to non directed link
1 configured track
2 configured ip sla
3 configured access-list
4 configured NAT
5 ...
0
votes
1
answer
236
views
Is it possible to allow/deny connections to a domain name using Access Control Lists on Aruba switch?
I'm working on an Aruba 2900 series switch and I'd like to restrict any traffic except traffic from/to a handful of domain names.
What I have to far:
ip access-list extended "production"
...
user70842
2
votes
2
answers
291
views
Static NAT and PAT
I have two private IP addresses, want to make them NAT to 203.0.113.0/2 public IP address.
WAY 1 : Static NAT (2 ip addresses NATted to one by manually)
WAY 2 : PAT (Router gives port number ...
- 21
0
votes
2
answers
61
views
meaning of acl configurations?
how do we know what ACL configuration mean? an example access-list 89 permit tcp host 192.168.10.2 any eq www? does this allow the traffic from the host 192.168.10.2 inside? i'm a bit confused. any ...
- 1
0
votes
2
answers
284
views
Slotted ALOHA efficiency
In slotted ALOHA, the maximum efficiency is 36.8% when only one station transmits in one time slot . My question is, if only one station is transmitting in one time slot, then there will be no ...
- 111
0
votes
2
answers
98
views
Why doesn't NAT drop packets with spoofed public source IP?
As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/,
The following code:
ip nat inside source list INSIDE pool OUTSIDE overload
will translate packets with a ...
1
vote
1
answer
35
views
Is this extended acl valid?
Permit tcp any eq 80 host 10.23.3.10 eq 80
I would like to permit any address to reach the host 10.23.3.10 strictly on port 80
This is a school lab exercise. The question goes, for inbound traffic ...
- 13
1
vote
1
answer
34
views
Router Extended Access Control List
Why can't we place the Extended ACL close to the destination not the source ? What will happen if we do so ?
- 37
0
votes
1
answer
65
views
Router Standard ACL
I was configuring Standard ACL on router 1841 on Cisco Packet Tracer with the help of command access-list 1 permit 172.16.40.3 0.0.0.0 and access-list 1 deny 172.16.40.4 0.0.0.0 and then I applied ...
- 37
1
vote
1
answer
37
views
Access List With Site To Site VPN
I have two juniper firewalls, an SSG-320M (screenos) and an SRX 340 (junos). I'm required to connect to a third party with an IPSEC VPN, however I'd like some additional protection from my firewall.
...
- 51
1
vote
3
answers
1k
views
How to configure NAT between 2 private network ? CISCO routers
If anyone can help with configurations it will be helpful
- 111
1
vote
2
answers
2k
views
Why my simple standard ACL outbound doesn't block the gateway's traffic/ping of the VLAN's SVI?
I am using a router/switch Cisco C1111-8p with IOS XE 16.8.
I have 3 VLANs:
1: native/management
20: dev
50: Guests
I'd like to block Guests/VLAN50 to communicate with anybody else but Internet.
...
- 396
2
votes
2
answers
706
views
ACL: Deny specific host not working
I'm trying to create an acl for use with a nat but I can't get the deny statements working.
All hosts on a private network should be accessible, except from a server which should not be accessible ...
- 23
0
votes
1
answer
60
views
How do I block IPs on my network? [closed]
I manage a network meant for specific people, who in turn illegally share the Wifi SSID logins with friends (and so repeated changing of passwords isn't a good option).
How do I configure the border ...
- 61
1
vote
1
answer
339
views
Permit IP Directed Broadcast on DELL FTOS
OK so in cisco land you can add an acl to the ip directed broadcas command, but this option does not appear in FTOS (Dell Networking OS 9)
if you enable ip directed broadcast on the vlan and then ...
- 13
1
vote
0
answers
14
views
Can Technical support have remote access to my computer? [closed]
I was having problems with my computer which has windows 10. So I contacted with a live agent of Microsoft and followed some procedures and gave him remote access to my computer. While working, my ...
- 11
4
votes
2
answers
147
views
Whether we usual use dot-decimal notation to represent network or IP by opposite mask?
Whether we usual use dot-decimal notation to represent network or IP by opposite mask?
10.10.10.0 0.0.0.255 # a network
10.10.10.0 255.255.255.0 # a IP
Update
if we represent a network, we can use ...
- 1,747
3
votes
2
answers
316
views
Standard access list
I have following setup
Vlan10
Pc1 192.168.10.20
Vlan20
Pc2 192.168.20.20
Vlan21
Pc2 192.168.21.20
Subnet :255.255.255.0
All connected to layer 3 switch
I have ...
- 227
2
votes
1
answer
21k
views
how to deny ping from one direction but not the other using Access-list
Hello everyone.
What I'm trying to do is to deny ping access from the 12.12.12.0 network to reach the 10.10.10.0 network but not deny ping access to go from 10.10.10.0 network and reach the 12.12.12....
- 23
0
votes
1
answer
68
views
For ethernet with bandwidth B, how much time a node has to wait before sensing the channel after the first collision detected?
Let's say one node detected a collision at t=0, in B Mbps ethernet, how long will that node wait before sensing the channel again?
- 9
1
vote
2
answers
1k
views
Configuring static NAT on Cisco Router
I am trying to configure port forwarding on a Cisco 891F router given by an ISP and directly connected to servers in the 192.168.170.0/24 network. The ISP recommended using the ip nat inside source ...
- 280
4
votes
1
answer
2k
views
Multiple access lists on same vlan
I have 5 departments each with it's own vlan and i want some of them to ping some of them, and only want some of them to ping some of them back. Basically creating a hierarchy of vlans.
Concretely, ...
- 75
3
votes
1
answer
211
views
Access lists on vlans possible?
I have a building with some departments and each department has it's own vlan and subnet. so now all departments can communicate with each other, but i only want some of them to communicate with some. ...
- 75
3
votes
1
answer
3k
views
How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]
I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but ...
- 295
3
votes
2
answers
2k
views
Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL
I'm trying to allow VPN access through a specific public IP address on our company ASA. The ASA is currently configured with a /29 public IP address as follows:
Interface Ethernet0/0 "outside"
IP ...
- 51
0
votes
1
answer
267
views
How do I assign machines to a VLAN based on machine authentication and user authentication using a NPS RADIUS server? [closed]
We have company-issued laptops that users can log into using smart cards. Using the Tunnel-PVT-Groupd-ID RADIUS element, we can assign the machine to a VLAN based on the authenticated user. However, ...
1
vote
1
answer
41
views
Access Control Permissions
I have created a topolgy in packet tracer displaying two networks. I have cpnfigured VLANs on both of the networks and configured access control lists. However, I would like to configure access ...
- 21
2
votes
1
answer
1k
views
Waiting time in CSMA/CD doubt
I have a doubt regarding the time a particular node will wait after collision.
I am using numerical values here so that one can easily understand my doubt.
Suppose in a network, we have 2 nodes A ...
- 431
-1
votes
2
answers
59
views
Can the data usage be Oriented by Consume of Demand?
Let's imagine that a LAN house, solve to charge financially your users, through of data usage consumption and not by time of use.
It Is possible do control individually of assignment of data usage for ...
2
votes
1
answer
3k
views
Access list with SNMP v3 Cisco
I was wondering if someone could help me with something. I am trying to set up SNMP v3 but with access control. Now, I have made the user and group. That's all fine, but I can't seem to get the access ...
- 23
2
votes
2
answers
2k
views
ACL on Internet Facing Interface
I have to set up and design a network as illustrated in:
I need to configure ACLs on inside interface and outside one. However, when
I implemented the access-lists, the flow of traffic was affected ...
- 21
1
vote
1
answer
7k
views
Access-list won't show all hit matches
I have access-lists in place. When i use the show ip access-list command, some of access-lists show counters (hit counts), and some don't. If I change the rule from permit to deny, interesting traffic ...
- 82
0
votes
1
answer
487
views
Extended access list conflict condition will it cause override?
Corp1(config)# access-list 10 permit tcp 192.168.33.3 0.0.0.0 177.22.242.23 0.0.0.0 eq www
Corp1(config)# access-list 10 deny tcp 192.168.33.0 0.0.0.255 177.22.242.23 0.0.0.0 eq www
Corp1(config)# ...
- 111
2
votes
2
answers
1k
views
How to apply firewall between stations connected to AP? [closed]
When I'm configuring wireless interface in RouterOS or in fact most of APs in general there are basically 2 options for controlling traffic between stations connected to AP - forward all, and don't ...
- 231
1
vote
0
answers
462
views
Optimizing access control lists on a Cisco SG500X-48 Small Business switch
I am trying to optimize the access control list rules on a Cisco SG500X-48 Small Business switch (on Layer 3). The general aim is to regulate the traffic between two VLANs (e.g., 10 and 30) in such a ...
- 111
0
votes
1
answer
102
views
Wifi location based access control
I'd like to know if it is possible to determine a user's location with wi-fi and incorporate that into part of the identification, authentication and authorisation mechanism of the network?
This ...
- 103
1
vote
2
answers
1k
views
ASA Firewall Can PING cannot SSH to switch on different interface
There are three interfaces, TRUST (security level 100), UNTRUST (security level 0), and DMZ (security level 50).
I am on a network coming into the firewall via the UNTRUST interface. The switch I am ...
- 463
2
votes
1
answer
13k
views
ip ssh source-interface vlan - allow ssh from specific vlan not working
I am doing some practice on GNS3 related switch and want to allow SSH from specific VLAN Ex: vlan1
In GNS3 i used router with 16NM ethernet module to emulate switch, so i am using following command ...
- 4,371
3
votes
1
answer
707
views
Open up port for one IP
I have a Cisco 1921 and I want to allow one WAN IP number (lets call it 1.2.3.4) to access a server on the LAN. My WAN interface is GigabitEthernet0/0 and my LAN interface is GigabitEthernet0/1. I ...
- 133
2
votes
1
answer
719
views
Cisco ACL not working as expected
I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).
Using NMAP, ...
- 21
1
vote
2
answers
839
views
Multiple access and full/half duplex point-to-point links
In en.wikipedia.org/wiki/Channel_access_method,
A channel-access scheme is based on a multiplexing method, that allows several data streams or signals to share the same
communication channel or ...
- 1,545