Questions tagged [acl]
Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)
183
questions
0
votes
0answers
18 views
ACL on a layer 3 router [on hold]
i have 2 vlans,2 routers and 1 HQ server.both my vlans are connected to one router while my HQ server is connected to the other router and the routers are both connected together.So for all my vlans ...
-2
votes
0answers
23 views
Looking for large Cisco IPv4 IOS or ASA access-list examples [closed]
I've developed a MacOS Cisco IPv4 IOS/ASA GUI ACL analyzer. It handles small ACL samples fine but I've got a report that it fails with large ACLs (>10,000 lines in this particular bug report). ...
0
votes
1answer
38 views
how to send tcp packets between 2 hosts on same network
iam using mininet network simulation tool and i need to send tcp packets between 2 host hosts are 10.0.0.1,10.0.0.2 ,i used the hping3 but is sends ip packets also i used this command
hping3 -c 1 [...
3
votes
3answers
125 views
How to add multiple ip address in destination ip in acl rule
Iam trying to block a certain host from sending any message to any host in the network
is there is a way to do that or i have to deny host by host ?
2
votes
1answer
33 views
Using Extended ACL on destination instead of source
In the diagram we are required to block all the external user ping requests to the sever. For this I have created the following ACL on R1:
access-list 105 deny icmp any any echo
access-list 105 ...
2
votes
1answer
32 views
What interface would ACLs be under if two services were connected over a S-2-S VPN?
I am using the ADSM for ASA tool.
I am trying to connect a service to a mysql server using port 3306. The service runs on a server that is on another network to the mysql server. It has been ...
1
vote
2answers
28 views
Using Standard or Extended ACL for Telnet Connections
In the picture shown the left bottom router is to be secured from any telnet requests. Now will I use Extended ACL on every router router or can I use the standard ACL just?
-1
votes
3answers
29 views
ACL for DNS clarification
I do not understand why the second ACL is needed if all I want is to ensure all networks use a certain DNS server (for example 192.0.2.1)
access-list 112 permit udp any host 192.0.2.1 eq domain
...
0
votes
1answer
47 views
How do I apply ACL in the given topology?
I am trying to understand the concept of standard and extended ACL. In the given topology, the top router is Front Desk(192.168.11.0/24). The left router is Nurses (192.168.7.0/24), left bottom is ...
1
vote
1answer
19 views
How to group 3 hosts in ACE Ipv6 statement
I know for ipv6 ACE there is no wildcard mask, so if I want to add three hosts in one statement, for example, which prefix should I use for that network? (network 2001:db8:cafe:1/64, ::1 reserved as ...
1
vote
1answer
25 views
ACL not blocking IP or ICMP packets out of an interface
I created this network to do some general practice. Every host on the network can ping every other host. The routers are just using a basic RIPv2 configuration. All of the interfaces can ping all the ...
0
votes
1answer
65 views
Create ACL for VLAN
I've multiple switches in LAN network environment configured with 3 VLANs, namely VLAN A, VLAN B and VLAN C. Since VLAN A is only allow to access internet without having accessibility to internal ...
0
votes
1answer
55 views
What can I use to block all the ports of the WAN in a Cisco router?
I have set up my small network using Cisco ISR C1111-8p and a Cisco Wireless AP C1832i.
What can I use to block all the ports of the WAN?
Is there any security advantage blocking them rather than ...
2
votes
1answer
89 views
Why does the Implicit Rule prevent traffic from passing?
I an testing traffic forwarding between different DMZ with different security levels.
DMZ:
interface GigabitEthernet0/1.351
vlan 351
nameif dmz
security-level 10
ip address 10.100.20.1 255.255....
2
votes
2answers
127 views
Providing wildcard mask in extended ACL
Is it necessary to provide a wildcard mask in extended ACL?
For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows?
access-list 107 deny ...
1
vote
1answer
30 views
source and destination in access-list
I am a bit confused in the concept of source and destination. Consider that I have to create an extended acl which blocks the access of 192.16.3.0/24 from 192.16.7.0/24. In this case my source is 192....
1
vote
1answer
21 views
Permit only WEB server in ACL on router? [closed]
In that topology I need to configure
192.168.1.0/24 will block 10.10.20.20 host
192.168.2.0/24 will block 10.10.10.0/24 network
All users can view web page but can't ping etc ...
I done that top 2 ...
2
votes
2answers
50 views
ACL: Deny specific host not working
I'm trying to create an acl for use with a nat but I can't get the deny statements working.
All hosts on a private network should be accessible, except from a server which should not be accessible ...
1
vote
0answers
72 views
ACL to only output multicast traffic and allow IGMP messages back to router [closed]
In the EDIT, I have created a set of ACL so that an interface on router 1 can only allow multicast packets out to router 2 and allow for any IGMP messages to come into the router 1. Is what I have ...
3
votes
0answers
63 views
TCAM utilization on Nexus 9396 switches
I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic.
I am reading about TCAM and wanted to ...
0
votes
0answers
19 views
NAT->Multicast Setup->ACL? [duplicate]
I am a network newbie and would be amazing for some help.
I trying to input multicast (239.10.1.11) onto a router 0/0 interface and would like to output multicast on (239.0.0.2) on interface 0/1. The ...
3
votes
1answer
91 views
Allowing only routed traffic, block intra-VLAN forwarding
In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*.
There ...
3
votes
1answer
67 views
Traffic not send in IPsec with a Cisco ASA
I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below:
My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
0
votes
1answer
74 views
ASA access-list to object group
I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain?
access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
3
votes
1answer
60 views
L3 and L2 interfaces in ACL
What is L3 and L2 interfaces in ACL feature
and why ethernet access-lists will not support L3 interfaces
0
votes
1answer
23 views
Issue with Connectivity Over Next Hop Gateway (ASA) to Point to Point
I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. ...
0
votes
1answer
20 views
ACL and ACEs Query
So i'm configuring a basic network and I need to create a couple of Extended ACLs. Now my question is, does this ACE permit any TCP connection to the following subnet?
permit tcp 192.168.10.0 0.0.0....
0
votes
0answers
57 views
Block internet on a Cisco catalyst 3560 port
Good day
Is there a way to block a specific port in a Cisco Catalyst 3560 switch to block the user from accessing the internet but still have full access to the internal corporate resources. The ...
1
vote
1answer
41 views
Can we apply ACL in default route?
I have default route setup as
ip route 0.0.0.0/0 172.16.15.2
where 172.16.15.2 is internet connected router with NAT.
Here is some snippet of the router configuration:
interface GigabitEthernet0/...
1
vote
1answer
43 views
Exclude 10.63.128.0 10.63.255.255 or 10.63.128.0/17 range from 10.0.0.0/10
Please help to suggest a method to exclude IP range 10.63.128.0 10.63.255.255 from 10.0.0.0/10.
I have a access list 3100 to filter the traffic with rule 10 10.0.0.0 0.63.255.255 and now I have to ...
3
votes
1answer
26 views
I can't connect to a denied network in Packet Tracer
I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping ...
5
votes
1answer
332 views
ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files
I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated:
The Issue: I have set a new backup server and I want to back up data from ...
2
votes
2answers
459 views
Is “Host unreachable” the same as “Communication administratively prohibited” in Access List ping response?
Below is a portion of my topology.
Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this ...
1
vote
1answer
329 views
deny traffic from specific host on specific host
if you please I wanna ask how to apply standard Acl on the server,to deny any communication between it and the hosts connected to Houston router.
There is no CLI in the server or hosts to write a ...
3
votes
2answers
120 views
Standard access list
I have following setup
Vlan10
Pc1 192.168.10.20
Vlan20
Pc2 192.168.20.20
Vlan21
Pc2 192.168.21.20
Subnet :255.255.255.0
All connected to layer 3 switch
I have ...
2
votes
1answer
98 views
Issue with ACL and router on a stick network
I have implemented LAN design in packet tracer with 6 VLANS using router on a stick configuration. Everything seems to work without ACL but I'm trying to implement rules where only the 02nd floor ...
1
vote
1answer
74 views
Access list per port for 48-port switches
We have 3750g, 3750e, 4948, 2960 series Cisco switches and all of them are 48 ports so we want to create one standard access list per port switch and in every ACL we permit 5-6 prefix (short prefixes ...
2
votes
1answer
71 views
Firewall Rule 'Both Ways'
I'd like to think I have a good understanding of NAT and Firewall rules at a basic level, though please correct me if I'm wrong at any point. I've seen many products list their firewall requirements ...
1
vote
1answer
2k views
how to deny ping from one direction but not the other using Access-list
Hello everyone.
What I'm trying to do is to deny ping access from the 12.12.12.0 network to reach the 10.10.10.0 network but not deny ping access to go from 10.10.10.0 network and reach the 12.12.12....
1
vote
1answer
384 views
Cisco ASA - security levels vs. implicit global access rule
I try to understand how to combinate implicit global ACL witch security level.
1) In documentation there are: Traffic from Higher Security Level to Lower Security Level: Allow ALL traffic originating ...
2
votes
3answers
401 views
Do VLANs with no ACL assigned block inter-VLAN traffic by default?
Supposing I have:
int g1/0/11
switchport access vlan 11
int g1/0/12
switchport access vlan 12
int Vlan11
no ip address
int Vlan12
no ip address
By default, do VLANs with no ACLs block ...
1
vote
5answers
105 views
Pings from outside to my router's interface ip address despite ACL rules
I have access-list on my router like this:
access-list 101 permit ip 10.1.130.0 0.0.0.255 host 10.1.1.25
access-list 101 deny ip any any log
And interface ip address is like this:
interface ...
1
vote
1answer
39 views
Help with this acl
This is what i am trying to do
Deny the network that host 200.200.200.10 is on, telnet access to R3
Permit host 200.200.200.10 to telnet to R3
Deny host 200.200.200.10 all access to host 204.10 on ...
5
votes
2answers
138 views
Cisco Catalyst ACL one-way initiated traffic
i am trying to setup ACL on my core router, i have the following networks:
Data (192.168.32.0/24)
Voice (192.168.42.0/24)
Guest (192.168.100.0/24)
QA (192.168.101.0/24)
I would like the following ...
1
vote
1answer
78 views
QoS: Configuration failed. deny is not supported
object-group network ip-google
8.8.4.0 255.255.255.0
8.8.8.0 255.255.255.0
8.34.208.0 255.255.240.0
8.35.192.0 255.255.240.0
23.236.48.0 255.255.240.0
23.251.128.0 255....
1
vote
1answer
242 views
How to use ACL to deny sending packages to the GRE tunnel?
I need to do a small lab. The topology is shown on the image below:
What I need to do, is make static routing so all routers can ping each neighbour's physical interface, configure a GRE tunnel ...
6
votes
3answers
273 views
Cisco ASA 5510 - ACL Config Question
My company's email server is under attack from the following IP address blocks
92.63.193.0
5.188.9.0
Here are the corresponding WHOIS records for each network
% This is the RIPE Database query ...
1
vote
1answer
463 views
How two separate vlans communicate [closed]
i have 4 vlans in my network.VLAN 10,VLAN 20,VLAN 30 and VLAN 40. I need Vlan 10 should communicate with vlan 20 but not with others(VLAN 30 and 40).VLAN 30 should communicate with VLAN 40 but not ...
1
vote
1answer
151 views
Is an ACL needed when using PAT (dynamic nat)?
We have a single router (4331) that connects to our ISP. We do PAT (dynamic nat) to give users internet access. Now typically we'd have an OUTSIDE-IN ACL that blocks traffic from the internet. My ...
1
vote
1answer
101 views
Cisco ASA: virtual Pool IP not filtered via ACL
One of our Customers has a corporate network at three different locations.
Let's assume:
location A: 192.168.1.0/24
location B: 192.168.2.0/24 and
location C: 192.168.3.0/24
At each location a Cisco ...
