Questions tagged [acl]
Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)
213
questions
0
votes
1answer
39 views
Access TACACS+ Server through ASA
I am trying to set up TACACS+ for a project. The below image shows the layout of the network.
So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
1
vote
1answer
38 views
Cisco ASA Clientless SSL VPN Restrict Network Access
I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services.
I have set up a simple clientless SSL VPN which ...
0
votes
1answer
63 views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
1
vote
1answer
38 views
What's the procedure to limit a subnet on a Cisco router from seeing another subnet when both are using NAT?
I have a Cisco 891F router. The internet is hooked up to G8. The student network is Vlan 200, and the Office is Vlan 100.
(I know the internet has an internal subnet (192.168.1.5), but that's because ...
4
votes
1answer
164 views
Correct ACL rules to isolate WiFi traffic from other VLANs?
I have written ACL rules written for a Dell PowerConnect 8024F (which, for the most part, uses the Cisco ACL "language") to isolate WiFi traffic from the rest of the network but allow the ...
0
votes
1answer
64 views
Cisco ASA access-lists and net config
Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0
votes
2answers
35 views
Cisco MAC ACL loop holes
I know this is not a new topic but need to clarify a couple things.
I have a typical office with hosts connected to a Cisco 3560-X in same VLAN.
My goal is to prevent unauthorised hosts ever accessing ...
1
vote
0answers
26 views
ACL dont work - MASTER VLAN to see ALL OTHERS BUT NOT VICE VERSA [closed]
I am having a bunch of VLANS that are in our HQ. Idea is that only several subnet must see IT department VLAN and all others DONT but IT department must see all vlans.
I tried like this, to make all ...
0
votes
1answer
223 views
How do I apply an access list on a switch?
I'm configuring a very small network on packet tracer 8.0 and I have a single 2960-24TT switch which is connected to 2 PCs and 1 router. Everything is on the 24.17.2.0/24 network and I added a VLAN. I ...
3
votes
1answer
238 views
Cisco ACL numbering
This is a small technical question. I can't seem to find any information on this, so I thought I'd ask here.
I'm currently studying for my CCNA and I'm currently on the topic of ACLs. On IOS standard ...
1
vote
1answer
125 views
How to block telnet access for one particular network from all networks except one using Extended ACL
Scenerio is given in the picture. I want to block all the networks except 192.168.5.128/25 from doing telnet of 192.168.5.0/25.
1
vote
0answers
28 views
Access-class in denies telnet under specific configuration
So I created an Access-list to permit telnet from a specific subnet. Here is the network diagram.
I originally tried permitting the subnet 10.1.1.0 /24 to access the R4 vty lines 0 4. It was a ...
0
votes
0answers
60 views
Allow one way SSH on extended IP access list on Cisco switch
interface GigabitEthernet1/0/11
ip access-group VM01-BLOCK-SSH-ACCESS-OUT out
objective:
10.10.10.104 -x-> any 10.10.10.0/24 via SSH
any 10.10.10.0/24 via SSH ---> 10.10.10.104
Question: ...
0
votes
1answer
192 views
Cisco L2 switch port ACL options
I'm trying to understand Cisco Switch ACL options I can potentially use to limit traffic. Switch is a IE2000 series with Lanbase IOS. It is L2, with trunk port to uplink switches, multiple VLANs on ...
1
vote
1answer
174 views
Access list command for specific IP range in Cisco Router 1921
For example:
router(config)#ip access-list extended 101
router(config-ext-nacl)#10 per icmp any host 192.168.1.10
From second command line, how to write a command permit icmp any host range 192.168.1....
1
vote
1answer
144 views
VLAN Filtering not working
On Cisco devices I'm looking to enable some filtering for one specific vlan (id 110).
Here is my config : (192.33.57.177 is the DHCP server host)
ip access-list extended VLAN110-DHCP
permit ip any ...
0
votes
1answer
46 views
Blocking 2 VLANs from accessing a specific VLAN on a network
I'm working on a project in packet tracer and I have a server connected to VLAN 10.
VLAN 10 has a single server device on it and the IP scope is a /30.
I have 8 other VLANs across 2 sites. The 2 ...
0
votes
2answers
55 views
meaning of acl configurations?
how do we know what ACL configuration mean? an example access-list 89 permit tcp host 192.168.10.2 any eq www? does this allow the traffic from the host 192.168.10.2 inside? i'm a bit confused. any ...
0
votes
2answers
119 views
When do ACLs on SVIs get applied on Cisco Catalyst devices?
I don't understand exactly when an ACL will get applied when on an SVI. Given the following (pseudo) configuration
int vlan 100
ip address 10.0.0.1 255.255.255.0
ip access-list in in
ip access-...
0
votes
0answers
163 views
Juniper MX Routing Engine Firewall Filter
I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
0
votes
3answers
234 views
Egress filtering by blocking unused ports
Our company wants to block data exfiltration. They want to control outbound traffic going out from unused ports. I did traffic flow analysis at our edge firewalls to know which ports are used by our ...
0
votes
2answers
2k views
Permit ping and traceroute and deny all other services using an ACL
my topology is shown below:
I would like the networks that are connected to Hermes-Router to be accessible from all the other stations only when I use ping and traceroute. I tried to do this using an ...
2
votes
0answers
34 views
How to configure an ACL on ASA when the inside source IP address is translated by NAT? [closed]
I don't know how to configure an ACL when inside source nat is enabled.
In my example, I want to realize bidirectional communication with TCP port 30000 between 172.16.100.100(inside) and 10.10.10.10(...
1
vote
1answer
738 views
DNS expire-entry-timer has negative affect on ASA using FQDN ACL
I have a Cisco ASA using FQDN egress ACLs for a host that changes IP addresses every 10 mins (Apple APNS IP address pool). As soon as the TTL expires for the addresses, my internal server requests a ...
4
votes
1answer
1k views
Cisco Nexus 9300 TCAM carving
I have Cisco Nexus C9396PX L3 switch and i have configured bunch of ACL (inbound) on it to deny/permit traffic. now if i am trying to add more ACL then getting error that your TCAM table is full. here ...
2
votes
2answers
710 views
Restricting TFTP access from Host to Router using extended ACL in Cisco IOS
I am trying the below Extended ACLs to restrict TFTP but still I am able to upload files to the router using tftp. Not sure, what is wrong, can you all help?
Approach 1:
permit udp host <ip> ...
0
votes
4answers
523 views
ACL on routers to block TCP/UDP ports
How routers understand the layer 4 port numbers to be blocked in ACL?
When an ACL to block TCP/UDP traffic with certain port numbers is applied on a router/L3 interface , how will router understand ...
0
votes
1answer
158 views
N2K-C2248TP-1GE question
We are working with Cisco 2960 and Cisco 4948 switches as our top of rack switches and we want to purchase some N2K-C2248TP-1GE , and connect N2K-C2248TP-1GE to our edge switches, (our edge switches ...
1
vote
1answer
530 views
delete object network in cisco ASA with packet tracert
I used 5506 as firewall and I am trying to delete object network I created and it gives error as ERROR: unable to delete the object configuration. object (inside-net-obj) is being used.
commands I ...
2
votes
1answer
75 views
configure IPv6 ACL on interface WS-C3750X-48
I am using WS-C3750X-48 model switch. license is lanbase. I have activated cmd on my switch:
sdm prefer dual-ipv4-and-ipv6 routing. Then i did reload. After that, i will able to config IPv6 on ...
0
votes
1answer
49 views
Router Standard ACL
I was configuring Standard ACL on router 1841 on Cisco Packet Tracer with the help of command access-list 1 permit 172.16.40.3 0.0.0.0 and access-list 1 deny 172.16.40.4 0.0.0.0 and then I applied ...
0
votes
2answers
256 views
Nat ACL Question?
I am so confused with fundamentals that I used to be an expert in,
so I have this topology
Please answer to my questions separately,
Question 1) So if I have two DNS severs, and ofc two IP address(81....
3
votes
1answer
180 views
Access control on Cisco router with switchports?
I am working with a series 800 router which has inbuilt switchports.
I want to use 2 switchports for a VLAN (say VLAN 100).
On one port will have devices:
192.168.1.10
192.168.1.30
Connected to ...
0
votes
1answer
417 views
how to send tcp packets between 2 hosts on same network
iam using mininet network simulation tool and i need to send tcp packets between 2 host hosts are 10.0.0.1,10.0.0.2 ,i used the hping3 but is sends ip packets also i used this command
hping3 -c 1 [...
3
votes
3answers
867 views
How to add multiple ip address in destination ip in acl rule
Iam trying to block a certain host from sending any message to any host in the network
is there is a way to do that or i have to deny host by host ?
2
votes
1answer
82 views
Using Extended ACL on destination instead of source
In the diagram we are required to block all the external user ping requests to the sever. For this I have created the following ACL on R1:
access-list 105 deny icmp any any echo
access-list 105 ...
2
votes
1answer
45 views
What interface would ACLs be under if two services were connected over a S-2-S VPN?
I am using the ADSM for ASA tool.
I am trying to connect a service to a mysql server using port 3306. The service runs on a server that is on another network to the mysql server. It has been ...
1
vote
3answers
328 views
Using Standard or Extended ACL for Telnet Connections
In the picture shown the left bottom router is to be secured from any telnet requests. Now will I use Extended ACL on every router router or can I use the standard ACL just?
-1
votes
3answers
298 views
ACL for DNS clarification
I do not understand why the second ACL is needed if all I want is to ensure all networks use a certain DNS server (for example 192.0.2.1)
access-list 112 permit udp any host 192.0.2.1 eq domain
...
0
votes
1answer
103 views
How do I apply ACL in the given topology?
I am trying to understand the concept of standard and extended ACL. In the given topology, the top router is Front Desk(192.168.11.0/24). The left router is Nurses (192.168.7.0/24), left bottom is ...
1
vote
1answer
32 views
How to group 3 hosts in ACE Ipv6 statement
I know for ipv6 ACE there is no wildcard mask, so if I want to add three hosts in one statement, for example, which prefix should I use for that network? (network 2001:db8:cafe:1/64, ::1 reserved as ...
1
vote
1answer
138 views
ACL not blocking IP or ICMP packets out of an interface
I created this network to do some general practice. Every host on the network can ping every other host. The routers are just using a basic RIPv2 configuration. All of the interfaces can ping all the ...
0
votes
1answer
228 views
Create ACL for VLAN
I've multiple switches in LAN network environment configured with 3 VLANs, namely VLAN A, VLAN B and VLAN C. Since VLAN A is only allow to access internet without having accessibility to internal ...
0
votes
1answer
442 views
What can I use to block all the ports of the WAN in a Cisco router?
I have set up my small network using Cisco ISR C1111-8p and a Cisco Wireless AP C1832i.
What can I use to block all the ports of the WAN?
Is there any security advantage blocking them rather than ...
2
votes
1answer
2k views
Why does the Implicit Rule prevent traffic from passing?
I an testing traffic forwarding between different DMZ with different security levels.
DMZ:
interface GigabitEthernet0/1.351
vlan 351
nameif dmz
security-level 10
ip address 10.100.20.1 255.255....
2
votes
2answers
725 views
Providing wildcard mask in extended ACL
Is it necessary to provide a wildcard mask in extended ACL?
For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows?
access-list 107 deny ...
1
vote
1answer
53 views
source and destination in access-list
I am a bit confused in the concept of source and destination. Consider that I have to create an extended acl which blocks the access of 192.16.3.0/24 from 192.16.7.0/24. In this case my source is 192....
1
vote
1answer
46 views
Permit only WEB server in ACL on router? [closed]
In that topology I need to configure
192.168.1.0/24 will block 10.10.20.20 host
192.168.2.0/24 will block 10.10.10.0/24 network
All users can view web page but can't ping etc ...
I done that top 2 ...
2
votes
2answers
383 views
ACL: Deny specific host not working
I'm trying to create an acl for use with a nat but I can't get the deny statements working.
All hosts on a private network should be accessible, except from a server which should not be accessible ...
1
vote
0answers
430 views
ACL to only output multicast traffic and allow IGMP messages back to router [closed]
In the EDIT, I have created a set of ACL so that an interface on router 1 can only allow multicast packets out to router 2 and allow for any IGMP messages to come into the router 1. Is what I have ...
