Network Engineering

Questions tagged [acl]

Ask Question

Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)

198 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

How does an ACL work which permits outside-in-traffic and whose destination is outside network? [closed]

I'm very confused about an ACL in asa which permits outside-in-traffics and whose destination is outside network. I need to know if the configuration below is possible. If so, would you tell me if it ...
0
votes
1answer
16 views

Blocking 2 VLANs from accessing a specific VLAN on a network

I'm working on a project in packet tracer and I have a server connected to VLAN 10. VLAN 10 has a single server device on it and the IP scope is a /30. I have 8 other VLANs across 2 sites. The 2 ...
0
votes
2answers
34 views

meaning of acl configurations?

how do we know what ACL configuration mean? an example access-list 89 permit tcp host 192.168.10.2 any eq www? does this allow the traffic from the host 192.168.10.2 inside? i'm a bit confused. any ...
0
votes
1answer
31 views

When do ACLs on SVIs get applied on Cisco Catalyst devices?

I don't understand exactly when an ACL will get applied when on an SVI. Given the following (pseudo) configuration int vlan 100 ip address 10.0.0.1 255.255.255.0 ip access-list in in ip access-...
0
votes
0answers
40 views

Juniper MX Routing Engine Firewall Filter

I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
0
votes
3answers
76 views

Egress filtering by blocking unused ports

Our company wants to block data exfiltration. They want to control outbound traffic going out from unused ports. I did traffic flow analysis at our edge firewalls to know which ports are used by our ...
0
votes
2answers
237 views

Permit ping and traceroute and deny all other services using an ACL

my topology is shown below: I would like the networks that are connected to Hermes-Router to be accessible from all the other stations only when I use ping and traceroute. I tried to do this using an ...
2
votes
0answers
32 views

How to configure an ACL on ASA when the inside source IP address is translated by NAT? [closed]

I don't know how to configure an ACL when inside source nat is enabled. In my example, I want to realize bidirectional communication with TCP port 30000 between 172.16.100.100(inside) and 10.10.10.10(...
1
vote
1answer
281 views

DNS expire-entry-timer has negative affect on ASA using FQDN ACL

I have a Cisco ASA using FQDN egress ACLs for a host that changes IP addresses every 10 mins (Apple APNS IP address pool). As soon as the TTL expires for the addresses, my internal server requests a ...
4
votes
1answer
331 views

Cisco Nexus 9300 TCAM carving

I have Cisco Nexus C9396PX L3 switch and i have configured bunch of ACL (inbound) on it to deny/permit traffic. now if i am trying to add more ACL then getting error that your TCAM table is full. here ...
2
votes
2answers
194 views

Restricting TFTP access from Host to Router using extended ACL in Cisco IOS

I am trying the below Extended ACLs to restrict TFTP but still I am able to upload files to the router using tftp. Not sure, what is wrong, can you all help? Approach 1: permit udp host <ip> ...
0
votes
4answers
132 views

ACL on routers to block TCP/UDP ports

How routers understand the layer 4 port numbers to be blocked in ACL? When an ACL to block TCP/UDP traffic with certain port numbers is applied on a router/L3 interface , how will router understand ...
0
votes
1answer
60 views

N2K-C2248TP-1GE question

We are working with Cisco 2960 and Cisco 4948 switches as our top of rack switches and we want to purchase some N2K-C2248TP-1GE , and connect N2K-C2248TP-1GE to our edge switches, (our edge switches ...
1
vote
1answer
209 views

delete object network in cisco ASA with packet tracert

I used 5506 as firewall and I am trying to delete object network I created and it gives error as ERROR: unable to delete the object configuration. object (inside-net-obj) is being used. commands I ...
2
votes
1answer
65 views

configure IPv6 ACL on interface WS-C3750X-48

I am using  WS-C3750X-48 model switch. license is lanbase. I have activated cmd on my switch: sdm prefer dual-ipv4-and-ipv6 routing. Then i did reload. After that, i will able to config IPv6 on ...
0
votes
1answer
37 views

Router Standard ACL

I was configuring Standard ACL on router 1841 on Cisco Packet Tracer with the help of command access-list 1 permit 172.16.40.3 0.0.0.0 and access-list 1 deny 172.16.40.4 0.0.0.0 and then I applied ...
0
votes
1answer
112 views

Nat ACL Question?

I am so confused with fundamentals that I used to be an expert in, so I have this topology Please answer to my questions separately, Question 1) So if I have two DNS severs, and ofc two IP address(81....
3
votes
1answer
165 views

Access control on Cisco router with switchports?

I am working with a series 800 router which has inbuilt switchports. I want to use 2 switchports for a VLAN (say VLAN 100). On one port will have devices: 192.168.1.10 192.168.1.30 Connected to ...
0
votes
1answer
161 views

how to send tcp packets between 2 hosts on same network

iam using mininet network simulation tool and i need to send tcp packets between 2 host hosts are 10.0.0.1,10.0.0.2 ,i used the hping3 but is sends ip packets also i used this command hping3 -c 1 [...
3
votes
3answers
399 views

How to add multiple ip address in destination ip in acl rule

Iam trying to block a certain host from sending any message to any host in the network is there is a way to do that or i have to deny host by host ?
2
votes
1answer
39 views

Using Extended ACL on destination instead of source

In the diagram we are required to block all the external user ping requests to the sever. For this I have created the following ACL on R1: access-list 105 deny icmp any any echo access-list 105 ...
2
votes
1answer
39 views

What interface would ACLs be under if two services were connected over a S-2-S VPN?

I am using the ADSM for ASA tool. I am trying to connect a service to a mysql server using port 3306. The service runs on a server that is on another network to the mysql server. It has been ...
1
vote
3answers
115 views

Using Standard or Extended ACL for Telnet Connections

In the picture shown the left bottom router is to be secured from any telnet requests. Now will I use Extended ACL on every router router or can I use the standard ACL just?
-1
votes
3answers
68 views

ACL for DNS clarification

I do not understand why the second ACL is needed if all I want is to ensure all networks use a certain DNS server (for example 192.0.2.1) access-list 112 permit udp any host 192.0.2.1 eq domain ...
0
votes
1answer
61 views

How do I apply ACL in the given topology?

I am trying to understand the concept of standard and extended ACL. In the given topology, the top router is Front Desk(192.168.11.0/24). The left router is Nurses (192.168.7.0/24), left bottom is ...
1
vote
1answer
29 views

How to group 3 hosts in ACE Ipv6 statement

I know for ipv6 ACE there is no wildcard mask, so if I want to add three hosts in one statement, for example, which prefix should I use for that network? (network 2001:db8:cafe:1/64, ::1 reserved as ...
1
vote
1answer
43 views

ACL not blocking IP or ICMP packets out of an interface

I created this network to do some general practice. Every host on the network can ping every other host. The routers are just using a basic RIPv2 configuration. All of the interfaces can ping all the ...
0
votes
1answer
104 views

Create ACL for VLAN

I've multiple switches in LAN network environment configured with 3 VLANs, namely VLAN A, VLAN B and VLAN C. Since VLAN A is only allow to access internet without having accessibility to internal ...
0
votes
1answer
167 views

What can I use to block all the ports of the WAN in a Cisco router?

I have set up my small network using Cisco ISR C1111-8p and a Cisco Wireless AP C1832i. What can I use to block all the ports of the WAN? Is there any security advantage blocking them rather than ...
2
votes
1answer
784 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
2answers
441 views

Providing wildcard mask in extended ACL

Is it necessary to provide a wildcard mask in extended ACL? For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows? access-list 107 deny ...
1
vote
1answer
33 views

source and destination in access-list

I am a bit confused in the concept of source and destination. Consider that I have to create an extended acl which blocks the access of 192.16.3.0/24 from 192.16.7.0/24. In this case my source is 192....
1
vote
1answer
31 views

Permit only WEB server in ACL on router? [closed]

In that topology I need to configure 192.168.1.0/24 will block 10.10.20.20 host 192.168.2.0/24 will block 10.10.10.0/24 network All users can view web page but can't ping etc ... I done that top 2 ...
2
votes
2answers
155 views

ACL: Deny specific host not working

I'm trying to create an acl for use with a nat but I can't get the deny statements working. All hosts on a private network should be accessible, except from a server which should not be accessible ...
1
vote
0answers
287 views

ACL to only output multicast traffic and allow IGMP messages back to router [closed]

In the EDIT, I have created a set of ACL so that an interface on router 1 can only allow multicast packets out to router 2 and allow for any IGMP messages to come into the router 1. Is what I have ...
3
votes
0answers
255 views

TCAM utilization on Nexus 9396 switches

I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic. I am reading about TCAM and wanted to ...
3
votes
1answer
489 views

Allowing only routed traffic, block intra-VLAN forwarding

In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*. There ...
3
votes
1answer
266 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
1
vote
1answer
265 views

ASA access-list to object group

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain? access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
3
votes
1answer
373 views

L3 and L2 interfaces in ACL

What is L3 and L2 interfaces in ACL feature and why ethernet access-lists will not support L3 interfaces
0
votes
1answer
27 views

Issue with Connectivity Over Next Hop Gateway (ASA) to Point to Point

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. ...
0
votes
1answer
23 views

ACL and ACEs Query

So i'm configuring a basic network and I need to create a couple of Extended ACLs. Now my question is, does this ACE permit any TCP connection to the following subnet? permit tcp 192.168.10.0 0.0.0....
0
votes
0answers
99 views

Block internet on a Cisco catalyst 3560 port

Good day Is there a way to block a specific port in a Cisco Catalyst 3560 switch to block the user from accessing the internet but still have full access to the internal corporate resources. The ...
1
vote
1answer
163 views

Can we apply ACL in default route?

I have default route setup as ip route 0.0.0.0/0 172.16.15.2 where 172.16.15.2 is internet connected router with NAT. Here is some snippet of the router configuration: interface GigabitEthernet0/...
2
votes
1answer
45 views

Exclude 10.63.128.0 10.63.255.255 or 10.63.128.0/17 range from 10.0.0.0/10

Please help to suggest a method to exclude IP range 10.63.128.0 10.63.255.255 from 10.0.0.0/10. I have a access list 3100 to filter the traffic with rule 10 10.0.0.0 0.63.255.255 and now I have to ...
3
votes
1answer
44 views

I can't connect to a denied network in Packet Tracer

I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping ...
5
votes
1answer
1k views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
2
votes
2answers
1k views

Is “Host unreachable” the same as “Communication administratively prohibited” in Access List ping response?

Below is a portion of my topology. Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this ...
1
vote
1answer
1k views

deny traffic from specific host on specific host

if you please I wanna ask how to apply standard Acl on the server,to deny any communication between it and the hosts connected to Houston router. There is no CLI in the server or hosts to write a ...
3
votes
2answers
202 views

Standard access list

I have following setup Vlan10 Pc1 192.168.10.20 Vlan20 Pc2 192.168.20.20 Vlan21 Pc2 192.168.21.20 Subnet :255.255.255.0 All connected to layer 3 switch I have ...

1
2 3 4