Questions tagged [acl]

Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)

Filter by
Sorted by
Tagged with
1 vote
1 answer
112 views

Access list and interface vlan

Pleasae I am facing this problem, the ping is always successful from 10.16.13.2 to 192.168.0.3 even if Iam configuring the acl in the 'in indirection'. show ip access-list Extended IP access list ...
Asma B's user avatar
  • 41
0 votes
1 answer
87 views

ASA cannot get traffic to pass port forward

I'm not able to get port forwarding to work for some reason on my asa 5555-x. I have tried the below config: ! object network SERVER host 192.168.1.20 ! object service SERVICE_TCP_9982 service tcp ...
The amateur programmer's user avatar
0 votes
0 answers
12 views

Access list with two pcs and two routers [duplicate]

I have Router0, on G0/0 connected PC0 with ip192.168.1.2 /24, on Router1 on G0/1.3 connected PC1 with network 192.168.3.2 /24. I need PC0 to be able to ping PC1 and PC1 cannot ping PC0. I have tried ...
binmarqwww's user avatar
0 votes
1 answer
34 views

ACLs block connection

Here is my configuration on ISP router: interface GigabitEthernet0/0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255....
Gekko's user avatar
  • 27
1 vote
2 answers
699 views

Exclude a certain vlan/subnet from layer3 inter-vlan routing

We have new gen aruba (hpe) switches in our environment. There is a backbone (5412R zl2) which all edge switches are connected to. The edge switches are also layer 3 (2930F). The backbone delivers ...
shafuq's user avatar
  • 137
1 vote
2 answers
59 views

Huawei Cloudengine 6851 ipv6 acl not matching

I have a Huawei 6851 and this is my config acl ipv6 number 3006 description MY-IPv6 rule 10 permit ipv6 source 2001:x:x:x::x:x/112 rule 20 deny ipv6 destination 2001:x:x:x::x:y/128 rule 30 permit ipv6 ...
Blackmetal's user avatar
0 votes
1 answer
125 views

Blocking traffic means can't access that server?

I know this is a super newbie question. I recently learn about firewall and you would know there is security levels. The higher levels can send the traffic but cannot get it from the lower one. I am ...
Myung Seok Kang's user avatar
0 votes
1 answer
496 views

Cisco router access list not working as expected

I'm trying to set up a network in packet tracer with inter-VLAN routing. I need to restrict one of the VLANs to only accept traffic from the 172.25.30.0/24 network. To do this I am using an access ...
josh_SWR's user avatar
5 votes
3 answers
4k views

Difference between firewall and ACL

I have found many answers to this question, none of which satisfy me due to lack of detail. Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
GalSuchetzky's user avatar
1 vote
1 answer
296 views

Inherent flaw in stateless firewalls?

I am but a lowly (software) developer dabbling with setting up a network in AWS and am having trouble understanding the fundamentals of stateless firewalls, or Network ACLs as they're also referred to ...
parmsib's user avatar
  • 13
1 vote
0 answers
91 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
DavidM's user avatar
  • 171
1 vote
1 answer
714 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
DavidM's user avatar
  • 171
2 votes
1 answer
485 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
DavidM's user avatar
  • 171
1 vote
1 answer
165 views

Configure AAA on a router - Extended ACLs

How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
maggiejmyers1973's user avatar
1 vote
1 answer
84 views

What's the procedure to limit a subnet on a Cisco router from seeing another subnet when both are using NAT?

I have a Cisco 891F router. The internet is hooked up to G8. The student network is Vlan 200, and the Office is Vlan 100. (I know the internet has an internal subnet (192.168.1.5), but that's because ...
TBone's user avatar
  • 113
4 votes
1 answer
676 views

Correct ACL rules to isolate WiFi traffic from other VLANs?

I have written ACL rules written for a Dell PowerConnect 8024F (which, for the most part, uses the Cisco ACL "language") to isolate WiFi traffic from the rest of the network but allow the ...
quantum's user avatar
  • 177
0 votes
2 answers
173 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
David Huang's user avatar
0 votes
2 answers
70 views

Cisco MAC ACL loop holes

I know this is not a new topic but need to clarify a couple things. I have a typical office with hosts connected to a Cisco 3560-X in same VLAN. My goal is to prevent unauthorised hosts ever accessing ...
Juan Cabrio's user avatar
1 vote
0 answers
35 views

ACL dont work - MASTER VLAN to see ALL OTHERS BUT NOT VICE VERSA [closed]

I am having a bunch of VLANS that are in our HQ. Idea is that only several subnet must see IT department VLAN and all others DONT but IT department must see all vlans. I tried like this, to make all ...
Milan Grujic's user avatar
0 votes
1 answer
2k views

How do I apply an access list on a switch?

I'm configuring a very small network on packet tracer 8.0 and I have a single 2960-24TT switch which is connected to 2 PCs and 1 router. Everything is on the 24.17.2.0/24 network and I added a VLAN. I ...
BloodLord's user avatar
3 votes
1 answer
277 views

Cisco ACL numbering

This is a small technical question. I can't seem to find any information on this, so I thought I'd ask here. I'm currently studying for my CCNA and I'm currently on the topic of ACLs. On IOS standard ...
Kibartas's user avatar
  • 133
1 vote
1 answer
467 views

How to block telnet access for one particular network from all networks except one using Extended ACL

Scenerio is given in the picture. I want to block all the networks except 192.168.5.128/25 from doing telnet of 192.168.5.0/25.
Umair's user avatar
  • 21
1 vote
0 answers
95 views

Access-class in denies telnet under specific configuration

So I created an Access-list to permit telnet from a specific subnet. Here is the network diagram. I originally tried permitting the subnet 10.1.1.0 /24 to access the R4 vty lines 0 4. It was a ...
Angel Gd's user avatar
0 votes
0 answers
206 views

Allow one way SSH on extended IP access list on Cisco switch

interface GigabitEthernet1/0/11 ip access-group VM01-BLOCK-SSH-ACCESS-OUT out objective: 10.10.10.104 -x-> any 10.10.10.0/24 via SSH any 10.10.10.0/24 via SSH ---> 10.10.10.104 Question: ...
Thomas G. Lau's user avatar
0 votes
1 answer
392 views

Cisco L2 switch port ACL options

I'm trying to understand Cisco Switch ACL options I can potentially use to limit traffic. Switch is a IE2000 series with Lanbase IOS. It is L2, with trunk port to uplink switches, multiple VLANs on ...
J T's user avatar
  • 1
1 vote
1 answer
362 views

Access list command for specific IP range in Cisco Router 1921

For example: router(config)#ip access-list extended 101 router(config-ext-nacl)#10 per icmp any host 192.168.1.10 From second command line, how to write a command permit icmp any host range 192.168.1....
Tony Lee's user avatar
1 vote
1 answer
280 views

VLAN Filtering not working

On Cisco devices I'm looking to enable some filtering for one specific vlan (id 110). Here is my config : (192.33.57.177 is the DHCP server host) ip access-list extended VLAN110-DHCP permit ip any ...
Jeremy G.'s user avatar
  • 787
0 votes
1 answer
686 views

Blocking 2 VLANs from accessing a specific VLAN on a network

I'm working on a project in packet tracer and I have a server connected to VLAN 10. VLAN 10 has a single server device on it and the IP scope is a /30. I have 8 other VLANs across 2 sites. The 2 ...
LordVader's user avatar
0 votes
2 answers
62 views

meaning of acl configurations?

how do we know what ACL configuration mean? an example access-list 89 permit tcp host 192.168.10.2 any eq www? does this allow the traffic from the host 192.168.10.2 inside? i'm a bit confused. any ...
hithere's user avatar
0 votes
2 answers
479 views

When do ACLs on SVIs get applied on Cisco Catalyst devices?

I don't understand exactly when an ACL will get applied when on an SVI. Given the following (pseudo) configuration int vlan 100 ip address 10.0.0.1 255.255.255.0 ip access-list in in ip access-...
John Moffitt's user avatar
0 votes
0 answers
340 views

Juniper MX Routing Engine Firewall Filter

I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
Ben's user avatar
  • 157
0 votes
3 answers
439 views

Egress filtering by blocking unused ports

Our company wants to block data exfiltration. They want to control outbound traffic going out from unused ports. I did traffic flow analysis at our edge firewalls to know which ports are used by our ...
user3063785's user avatar
0 votes
2 answers
4k views

Permit ping and traceroute and deny all other services using an ACL

my topology is shown below: I would like the networks that are connected to Hermes-Router to be accessible from all the other stations only when I use ping and traceroute. I tried to do this using an ...
Giannis Matsarokis's user avatar
2 votes
0 answers
122 views

How to configure an ACL on ASA when the inside source IP address is translated by NAT? [closed]

I don't know how to configure an ACL when inside source nat is enabled. In my example, I want to realize bidirectional communication with TCP port 30000 between 172.16.100.100(inside) and 10.10.10.10(...
masafumi_from_Japan's user avatar
1 vote
1 answer
1k views

DNS expire-entry-timer has negative affect on ASA using FQDN ACL

I have a Cisco ASA using FQDN egress ACLs for a host that changes IP addresses every 10 mins (Apple APNS IP address pool). As soon as the TTL expires for the addresses, my internal server requests a ...
Pobbel's user avatar
  • 11
4 votes
1 answer
3k views

Cisco Nexus 9300 TCAM carving

I have Cisco Nexus C9396PX L3 switch and i have configured bunch of ACL (inbound) on it to deny/permit traffic. now if i am trying to add more ACL then getting error that your TCAM table is full. here ...
Satish's user avatar
  • 4,369
2 votes
2 answers
1k views

Restricting TFTP access from Host to Router using extended ACL in Cisco IOS

I am trying the below Extended ACLs to restrict TFTP but still I am able to upload files to the router using tftp. Not sure, what is wrong, can you all help? Approach 1: permit udp host <ip> ...
Blake's user avatar
  • 57
0 votes
4 answers
1k views

ACL on routers to block TCP/UDP ports

How routers understand the layer 4 port numbers to be blocked in ACL? When an ACL to block TCP/UDP traffic with certain port numbers is applied on a router/L3 interface , how will router understand ...
user3306043's user avatar
0 votes
1 answer
245 views

N2K-C2248TP-1GE question

We are working with Cisco 2960 and Cisco 4948 switches as our top of rack switches and we want to purchase some N2K-C2248TP-1GE , and connect N2K-C2248TP-1GE to our edge switches, (our edge switches ...
Blackmetal's user avatar
3 votes
1 answer
870 views

delete object network in cisco ASA with packet tracert

I used 5506 as firewall and I am trying to delete object network I created and it gives error as ERROR: unable to delete the object configuration. object (inside-net-obj) is being used. commands I ...
Dinithi's user avatar
  • 153
2 votes
1 answer
100 views

configure IPv6 ACL on interface WS-C3750X-48

I am using  WS-C3750X-48 model switch. license is lanbase. I have activated cmd on my switch: sdm prefer dual-ipv4-and-ipv6 routing. Then i did reload. After that, i will able to config IPv6 on ...
Thomas's user avatar
  • 21
0 votes
1 answer
65 views

Router Standard ACL

I was configuring Standard ACL on router 1841 on Cisco Packet Tracer with the help of command access-list 1 permit 172.16.40.3 0.0.0.0 and access-list 1 deny 172.16.40.4 0.0.0.0 and then I applied ...
user60845's user avatar
2 votes
2 answers
332 views

Nat ACL Question?

I am so confused with fundamentals that I used to be an expert in, so I have this topology Please answer to my questions separately, Question 1) So if I have two DNS severs, and ofc two IP address(81....
Lord Arthas's user avatar
3 votes
1 answer
185 views

Access control on Cisco router with switchports?

I am working with a series 800 router which has inbuilt switchports. I want to use 2 switchports for a VLAN (say VLAN 100). On one port will have devices: 192.168.1.10 192.168.1.30 Connected to ...
user10021657's user avatar
0 votes
1 answer
633 views

how to send tcp packets between 2 hosts on same network

iam using mininet network simulation tool and i need to send tcp packets between 2 host hosts are 10.0.0.1,10.0.0.2 ,i used the hping3 but is sends ip packets also i used this command hping3 -c 1 [...
genral Hummel's user avatar
3 votes
3 answers
2k views

How to add multiple ip address in destination ip in acl rule

Iam trying to block a certain host from sending any message to any host in the network is there is a way to do that or i have to deny host by host ?
genral Hummel's user avatar
2 votes
1 answer
238 views

Using Extended ACL on destination instead of source

In the diagram we are required to block all the external user ping requests to the sever. For this I have created the following ACL on R1: access-list 105 deny icmp any any echo access-list 105 ...
Muhammad Ahmad's user avatar
2 votes
1 answer
56 views

What interface would ACLs be under if two services were connected over a S-2-S VPN?

I am using the ADSM for ASA tool. I am trying to connect a service to a mysql server using port 3306. The service runs on a server that is on another network to the mysql server. It has been ...
CrazyHorse019's user avatar
1 vote
3 answers
437 views

Using Standard or Extended ACL for Telnet Connections

In the picture shown the left bottom router is to be secured from any telnet requests. Now will I use Extended ACL on every router router or can I use the standard ACL just?
Muhammad Ahmad's user avatar
-1 votes
3 answers
871 views

ACL for DNS clarification

I do not understand why the second ACL is needed if all I want is to ensure all networks use a certain DNS server (for example 192.0.2.1) access-list 112 permit udp any host 192.0.2.1 eq domain ...
Novice Programmer's user avatar

1
2 3 4 5