Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [acl]

Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)

0
votes
1answer
48 views

What can I use to block all the ports of the WAN in a Cisco router?

I have set up my small network using Cisco ISR C1111-8p and a Cisco Wireless AP C1832i. What can I use to block all the ports of the WAN? Is there any security advantage blocking them rather than ...
1
vote
0answers
44 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
2answers
98 views

Providing wildcard mask in extended ACL

Is it necessary to provide a wildcard mask in extended ACL? For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows? access-list 107 deny ...
1
vote
1answer
27 views

source and destination in access-list

I am a bit confused in the concept of source and destination. Consider that I have to create an extended acl which blocks the access of 192.16.3.0/24 from 192.16.7.0/24. In this case my source is 192....
1
vote
1answer
20 views

Permit only WEB server in ACL on router? [closed]

In that topology I need to configure 192.168.1.0/24 will block 10.10.20.20 host 192.168.2.0/24 will block 10.10.10.0/24 network All users can view web page but can't ping etc ... I done that top 2 ...
2
votes
2answers
46 views

ACL: Deny specific host not working

I'm trying to create an acl for use with a nat but I can't get the deny statements working. All hosts on a private network should be accessible, except from a server which should not be accessible ...
1
vote
0answers
48 views

ACL to only output multicast traffic and allow IGMP messages back to router [closed]

In the EDIT, I have created a set of ACL so that an interface on router 1 can only allow multicast packets out to router 2 and allow for any IGMP messages to come into the router 1. Is what I have ...
2
votes
0answers
40 views

TCAM utilization on Nexus 9396 switches

I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic. I am reading about TCAM and wanted to ...
0
votes
0answers
19 views

NAT->Multicast Setup->ACL? [duplicate]

I am a network newbie and would be amazing for some help. I trying to input multicast (239.10.1.11) onto a router 0/0 interface and would like to output multicast on (239.0.0.2) on interface 0/1. The ...
3
votes
1answer
57 views

Allowing only routed traffic, block intra-VLAN forwarding

In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*. There ...
3
votes
1answer
58 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
0
votes
1answer
52 views

ASA access-list to object group

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain? access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
3
votes
1answer
40 views

L3 and L2 interfaces in ACL

What is L3 and L2 interfaces in ACL feature and why ethernet access-lists will not support L3 interfaces
0
votes
1answer
22 views

Issue with Connectivity Over Next Hop Gateway (ASA) to Point to Point

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. ...
0
votes
1answer
19 views

ACL and ACEs Query

So i'm configuring a basic network and I need to create a couple of Extended ACLs. Now my question is, does this ACE permit any TCP connection to the following subnet? permit tcp 192.168.10.0 0.0.0....
0
votes
0answers
53 views

Block internet on a Cisco catalyst 3560 port

Good day Is there a way to block a specific port in a Cisco Catalyst 3560 switch to block the user from accessing the internet but still have full access to the internal corporate resources. The ...
1
vote
1answer
38 views

Can we apply ACL in default route?

I have default route setup as ip route 0.0.0.0/0 172.16.15.2 where 172.16.15.2 is internet connected router with NAT. Here is some snippet of the router configuration: interface GigabitEthernet0/...
1
vote
1answer
40 views

Exclude 10.63.128.0 10.63.255.255 or 10.63.128.0/17 range from 10.0.0.0/10

Please help to suggest a method to exclude IP range 10.63.128.0 10.63.255.255 from 10.0.0.0/10. I have a access list 3100 to filter the traffic with rule 10 10.0.0.0 0.63.255.255 and now I have to ...
2
votes
1answer
24 views

I can't connect to a denied network in Packet Tracer

I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping ...
5
votes
0answers
224 views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
2
votes
2answers
341 views

Is “Host unreachable” the same as “Communication administratively prohibited” in Access List ping response?

Below is a portion of my topology. Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this ...
1
vote
1answer
211 views

deny traffic from specific host on specific host

if you please I wanna ask how to apply standard Acl on the server,to deny any communication between it and the hosts connected to Houston router. There is no CLI in the server or hosts to write a ...
3
votes
2answers
106 views

Standard access list

I have following setup Vlan10 Pc1 192.168.10.20 Vlan20 Pc2 192.168.20.20 Vlan21 Pc2 192.168.21.20 Subnet :255.255.255.0 All connected to layer 3 switch I have ...
3
votes
1answer
93 views

Issue with ACL and router on a stick network

I have implemented LAN design in packet tracer with 6 VLANS using router on a stick configuration. Everything seems to work without ACL but I'm trying to implement rules where only the 02nd floor ...
1
vote
1answer
72 views

Access list per port for 48-port switches

We have 3750g, 3750e, 4948, 2960 series Cisco switches and all of them are 48 ports so we want to create one standard access list per port switch and in every ACL we permit 5-6 prefix (short prefixes ...
2
votes
1answer
67 views

Firewall Rule 'Both Ways'

I'd like to think I have a good understanding of NAT and Firewall rules at a basic level, though please correct me if I'm wrong at any point. I've seen many products list their firewall requirements ...
1
vote
1answer
1k views

how to deny ping from one direction but not the other using Access-list

Hello everyone. What I'm trying to do is to deny ping access from the 12.12.12.0 network to reach the 10.10.10.0 network but not deny ping access to go from 10.10.10.0 network and reach the 12.12.12....
1
vote
1answer
346 views

Cisco ASA - security levels vs. implicit global access rule

I try to understand how to combinate implicit global ACL witch security level. 1) In documentation there are: Traffic from Higher Security Level to Lower Security Level: Allow ALL traffic originating ...
2
votes
3answers
358 views

Do VLANs with no ACL assigned block inter-VLAN traffic by default?

Supposing I have: int g1/0/11 switchport access vlan 11 int g1/0/12 switchport access vlan 12 int Vlan11 no ip address int Vlan12 no ip address By default, do VLANs with no ACLs block ...
1
vote
5answers
99 views

Pings from outside to my router's interface ip address despite ACL rules

I have access-list on my router like this: access-list 101 permit ip 10.1.130.0 0.0.0.255 host 10.1.1.25 access-list 101 deny ip any any log And interface ip address is like this: interface ...
1
vote
1answer
39 views

Help with this acl

This is what i am trying to do Deny the network that host 200.200.200.10 is on, telnet access to R3 Permit host 200.200.200.10 to telnet to R3 Deny host 200.200.200.10 all access to host 204.10 on ...
4
votes
2answers
122 views

Cisco Catalyst ACL one-way initiated traffic

i am trying to setup ACL on my core router, i have the following networks: Data (192.168.32.0/24) Voice (192.168.42.0/24) Guest (192.168.100.0/24) QA (192.168.101.0/24) I would like the following ...
1
vote
1answer
75 views

QoS: Configuration failed. deny is not supported

object-group network ip-google 8.8.4.0 255.255.255.0 8.8.8.0 255.255.255.0 8.34.208.0 255.255.240.0 8.35.192.0 255.255.240.0 23.236.48.0 255.255.240.0 23.251.128.0 255....
1
vote
1answer
208 views

How to use ACL to deny sending packages to the GRE tunnel?

I need to do a small lab. The topology is shown on the image below: What I need to do, is make static routing so all routers can ping each neighbour's physical interface, configure a GRE tunnel ...
5
votes
3answers
267 views

Cisco ASA 5510 - ACL Config Question

My company's email server is under attack from the following IP address blocks 92.63.193.0 5.188.9.0 Here are the corresponding WHOIS records for each network % This is the RIPE Database query ...
1
vote
1answer
437 views

How two separate vlans communicate [closed]

i have 4 vlans in my network.VLAN 10,VLAN 20,VLAN 30 and VLAN 40. I need Vlan 10 should communicate with vlan 20 but not with others(VLAN 30 and 40).VLAN 30 should communicate with VLAN 40 but not ...
1
vote
1answer
138 views

Is an ACL needed when using PAT (dynamic nat)?

We have a single router (4331) that connects to our ISP. We do PAT (dynamic nat) to give users internet access. Now typically we'd have an OUTSIDE-IN ACL that blocks traffic from the internet. My ...
1
vote
1answer
101 views

Cisco ASA: virtual Pool IP not filtered via ACL

One of our Customers has a corporate network at three different locations. Let's assume: location A: 192.168.1.0/24 location B: 192.168.2.0/24 and location C: 192.168.3.0/24 At each location a Cisco ...
2
votes
2answers
131 views

ACL not working HELP!

I want to block the traffic from the vlans 21 and 22 on the vlan 23 without blocking 24 and 29 with an extended access list but nothing happens. I'd like to know what's wrong in my config. Here's the ...
2
votes
2answers
253 views

Understanding Cisco standard access lists (Packet Tracer example)

Consider the following example: I have two networks (192.168.1.0 and 192.168.2.0) with one PC in each network (PC0 - 192.168.1.1 and PC1 - 192.168.2.1) and a router R0 with 2 interfaces connecting ...
2
votes
2answers
1k views

Cisco Port ACL Rule blocking port 80 appears to block all traffic

I have an ACL configured on an EHWIC card in a 2911 ISR, IOS 15.4, as below. If I have the rules for blocking port 80 in there, ALL traffic to that port appears to be blocked (SSH, telnet, RDP etc.) ...
4
votes
1answer
187 views

MAC ACL to prevent access to unauthorized computers

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...
1
vote
1answer
98 views

Extended ACL not working with “host”-Attribute in Cisco Packet Tracer

Here's the output (or the commands) which fails: Normally it should work! What's wrong here?
3
votes
1answer
445 views

ACL on trunk Port

our network infrastructure as showing the image below I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
1
vote
1answer
177 views

Traffic flow for internal traffic in Juniper SRX 650

I would like to know whether the Juniper SRX by default allows all the source and destination ports if all the devices are from the internal networking range. For eg, Src-10.10.x.x SrcPrt-any Des-10....
3
votes
1answer
94 views

How to permit behaviour in Cisco access-list commands?

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
2
votes
1answer
572 views

Firewall and VPN functionalities for a Cisco ISR4321 V/K9

I would like to know if I can setup ACLs with the access-list command with a Cisco ISR4321 V/K9. Are there restrictions (in comparison with a Cisco ISR4321 VSEC/K9)? Note the SEC part in the reference....
2
votes
1answer
64 views

ACL on Nexus 3064PQ performance

We are using this switch as L3 and planning to run some ACL to stop bad traffic. I never run ACL on switches so wondering is there any performance impact or how bad it will be? if anyone has any ...
1
vote
1answer
242 views

Cisco Router, Port Forwarding, ACL ordering

I'm new CCNA learner here. If I have the following access list: access-list 101 permit ip 10.10.0.0 0.0.255.255 any access-list 101 deny tcp host 10.10.0.1 eq 443 any access-list 101 deny tcp host ...
1
vote
1answer
2k views

ACL for DHCP configured on Cisco switch

We have a DHCP pool configured on Cisco L3 switch for hosts on SVI. Since we want to restrict connectivity to DHCP which is on the same switch. excluded 172.24.19.1-172.24.19.50 SVI IP 172.24.19.50 ...