Questions tagged [acl]
Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)
228 questions
3
votes
1
answer
383
views
Cisco IP Fragments ACL strange behavior
I am testing following ACL on Cisco 3850 L3 switch :
C3850#show ip access-lists 101
Extended IP access list 101
10 deny ip any any fragments
20 permit ip any any (268 matches)
I applied ...
- 4,389
3
votes
2
answers
5k
views
Configuring DMZ in ASA
I am fairly new to the ASA world. Basically I have exhausted all my search options, and turning to experts here for help. I have an ASA 5506-X with 4 interfaces. ASA is running OS 9.4(2) and I am ...
- 133
3
votes
1
answer
2k
views
Allowing only routed traffic, block intra-VLAN forwarding
In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*.
There ...
- 133
3
votes
1
answer
240
views
I can't connect to a denied network in Packet Tracer
I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping ...
3
votes
2
answers
325
views
Standard access list
I have following setup
Vlan10
Pc1 192.168.10.20
Vlan20
Pc2 192.168.20.20
Vlan21
Pc2 192.168.21.20
Subnet :255.255.255.0
All connected to layer 3 switch
I have ...
- 227
3
votes
1
answer
2k
views
ACL on trunk Port
our network infrastructure as showing the image below
I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
- 307
3
votes
1
answer
185
views
How to permit behaviour in Cisco access-list commands?
If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
- 33
3
votes
4
answers
1k
views
Syslog severity level to 5 + ACL BLOCKED log
I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages.
Is there a way to do this ? I've ...
- 180
3
votes
1
answer
7k
views
What all is classified as "Interesting traffic?"
So, recently I had read somewhere that when we write ACLs to permit local IP addresses to access those in an IP NAT pool, it's said that, "..when interesting traffic has been matched with the access ...
- 429
3
votes
2
answers
11k
views
How to decipher dropped packet from packet-tracer output?
I have a massive ACL that i'm dealing with and I can't seem to find what line is blocking me. Is there a way for packet-tracer to help me figure out more specifically where i'm getting blocked at?
...
- 754
3
votes
1
answer
44
views
ACL and PBR on Cisco Nexus
I have a Cisco Nexus switch that I'm using as my core router. It has a connection to a firewall that handles internet-bound traffic. The switch acts as the default gateway with a default route to the ...
- 33
3
votes
1
answer
1k
views
Traffic not send in IPsec with a Cisco ASA
I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below:
My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
- 881
3
votes
1
answer
2k
views
Understanding Cisco Extended ACL
I am trying to limit access to our SIP servers to only 209.85.2.10 however,
I am getting a little confused by the permit ip any any log. Will it not allow everything in? Without it, I loose all the ...
- 431
3
votes
1
answer
684
views
Simple egress block ACL on Cisco IOS
I have a Cisco 890 with IOS 15.4.
As brief summary of my configuration, FastEthernet 8 is the uplink and NATs the other interfaces (which are grouped into vlan 1).
I'm trying to block access to a ...
- 77
3
votes
1
answer
233
views
Apply an extended ACL on Cisco 7609 SIP-400
Good morning,
I have configured a pbr to apply it to a virtual-template
here is my route-map definition :
route-map to_virtual_template permit 10
match ip address 101
set ip next-hop X.X.X.1
...
- 501
3
votes
2
answers
1k
views
IP addrs Outside of DHCP range blocked by Cisco ASA 5505
My issue is this: I have a Cisco ASA which the INSIDE interface is set to DHCP lease IPs 10.1.10.104 - 254 ... I have a few static servers using the "lower" IP range (i.e. 10.1.10.11). The issue ...
- 463
3
votes
1
answer
623
views
Outbound Packet-Filtering on 3Com 5500G
I have a L3 3Com 5500G, and I'm trying to assign an outbound packet filtering on one GigabitEthernet, however, the only available feature is inbound.
Any ideas?
- 61
3
votes
1
answer
156
views
How to manage ACL in a routed network
I have a full mesh core network running OSPF. I use OSPF down to the "L3 Agg switches". Now I want to restrict traffic between some of the networks at our site, but how is this done when there is ...
- 406
3
votes
2
answers
1k
views
Restricting TFTP access from Host to Router using extended ACL in Cisco IOS
I am trying the below Extended ACLs to restrict TFTP but still I am able to upload files to the router using tftp. Not sure, what is wrong, can you all help?
Approach 1:
permit udp host <ip> ...
- 67
3
votes
2
answers
1k
views
Unexpected behavior referencing object-groups in access-lists on Catalyst 4500
I'm encountering some unexpected behavior when trying to reference object-groups in an access-list on my Catalyst 4500.
Goal: Restrict a VLAN from accessing other privately addressed subnets (...
- 357
2
votes
4
answers
2k
views
Do VLANs with no ACL assigned block inter-VLAN traffic by default?
Supposing I have:
int g1/0/11
switchport access vlan 11
int g1/0/12
switchport access vlan 12
int Vlan11
no ip address
int Vlan12
no ip address
By default, do VLANs with no ACLs block ...
- 211
2
votes
2
answers
1k
views
Providing wildcard mask in extended ACL
Is it necessary to provide a wildcard mask in extended ACL?
For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows?
access-list 107 deny ...
- 133
2
votes
2
answers
5k
views
Is "Host unreachable" the same as "Communication administratively prohibited" in Access List ping response?
Below is a portion of my topology.
Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this ...
- 69
2
votes
3
answers
1k
views
Understanding Cisco standard access lists (Packet Tracer example)
Consider the following example: I have two networks (192.168.1.0 and 192.168.2.0) with one PC in each network (PC0 - 192.168.1.1 and PC1 - 192.168.2.1) and a router R0 with 2 interfaces connecting ...
- 23
2
votes
1
answer
217
views
ACL on Nexus 3064PQ performance
We are using this switch as L3 and planning to run some ACL to stop bad traffic. I never run ACL on switches so wondering is there any performance impact or how bad it will be? if anyone has any ...
- 4,389
2
votes
2
answers
1k
views
ACL not working HELP!
I want to block the traffic from the vlans 21 and 22 on the vlan 23 without blocking 24 and 29 with an extended access list but nothing happens. I'd like to know what's wrong in my config.
Here's the ...
- 21
2
votes
1
answer
1k
views
ACL based on VLAN
I am trying to learn ACL on hp 2530.
When I use :
sh access-list command the following is displayed:
ACL-NAME-STR Show detailed information for an ACL.
config Show all ...
- 175
2
votes
2
answers
3k
views
Using ACLs to block traffic destined for the switch
There is a layer 3 switch which is responsible for inter-vlan routing. One VLAN (10, network: 172.16.10.0/24) cannot be accessed from any other VLANs (for management purposes). In order to do that I ...
- 153
2
votes
1
answer
4k
views
How does a Cisco ACL handle fragments
We have an ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a DNS amplification attack. so all source port for 53, and it was definitely a ...
- 4,389
2
votes
1
answer
921
views
Standard IP ACL inbound direction
The command syntax format of a standard ACL is
access-list access-list-number {permit|deny} {host|source source-wildcard|any}.
This is an example of the use of a standard ACL in order to block all ...
- 23
2
votes
1
answer
653
views
Cisco ASA Clientless SSL VPN Restrict Network Access
I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services.
I have set up a simple clientless SSL VPN which ...
- 171
2
votes
1
answer
5k
views
Why does the Implicit Rule prevent traffic from passing?
I an testing traffic forwarding between different DMZ with different security levels.
DMZ:
interface GigabitEthernet0/1.351
vlan 351
nameif dmz
security-level 10
ip address 10.100.20.1 255.255....
- 155
2
votes
1
answer
512
views
Issue with ACL and router on a stick network
I have implemented LAN design in packet tracer with 6 VLANS using router on a stick configuration. Everything seems to work without ACL but I'm trying to implement rules where only the 02nd floor ...
2
votes
1
answer
8k
views
Access-list won't show all hit matches
I have access-lists in place. When i use the show ip access-list command, some of access-lists show counters (hit counts), and some don't. If I change the rule from permit to deny, interesting traffic ...
- 92
2
votes
3
answers
680
views
ASA NAT & ACL question
object network obj-10.15.X.Y
host 10.15.X.X
nat (inside,outside) static 1.1.1.1
sh xlate | in 1.1.1.1
NAT from inside:10.15.X.Y to outside:1.1.1.1
access-list External_Access ...
- 317
2
votes
1
answer
744
views
Cisco ACL not working as expected
I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).
Using NMAP, ...
- 21
2
votes
1
answer
277
views
Using Extended ACL on destination instead of source
In the diagram we are required to block all the external user ping requests to the sever. For this I have created the following ACL on R1:
access-list 105 deny icmp any any echo
access-list 105 ...
- 133
2
votes
1
answer
58
views
What interface would ACLs be under if two services were connected over a S-2-S VPN?
I am using the ADSM for ASA tool.
I am trying to connect a service to a mysql server using port 3306. The service runs on a server that is on another network to the mysql server. It has been ...
- 167
2
votes
1
answer
53
views
Exclude 10.63.128.0 10.63.255.255 or 10.63.128.0/17 range from 10.0.0.0/10
Please help to suggest a method to exclude IP range 10.63.128.0 10.63.255.255 from 10.0.0.0/10.
I have a access list 3100 to filter the traffic with rule 10 10.0.0.0 0.63.255.255 and now I have to ...
2
votes
1
answer
128
views
Cisco BGP Prefix Lists
One of the benefits to Cisco's prefix lists is less CPU consumption over standard ACL`s. However I'm unable to find any further details.
So my questions is - why are prefix lists more efficient in ...
- 269
2
votes
1
answer
34k
views
Deleting Access Control List in Cisco Router
Let's say I have a access-list 1 with 5 permits.
And I would like to delete the third permit listing.
I know that I can simply do "no 30"
However, can I confirm that I can
no access-list 1 permit ...
- 83
2
votes
1
answer
1k
views
Cisco ACL for NTP
We have Cisco ACL configured for all inbound traffic and today i have add NTP to allow few remote NTP server to sync tim.
I have created object-group NTP group and multiple remote NTP server in that ...
- 4,389
2
votes
1
answer
3k
views
Router stateful ACL
Its very weird question but i want some suggestion for you. We have edge router ASR1000 where BGP running and 10G internet connection is terminated. Now i want to configure ACL on router to keep bad ...
- 4,389
2
votes
2
answers
852
views
ACL: Deny specific host not working
I'm trying to create an acl for use with a nat but I can't get the deny statements working.
All hosts on a private network should be accessible, except from a server which should not be accessible ...
- 23
2
votes
1
answer
1k
views
Firewall Rule 'Both Ways'
I'd like to think I have a good understanding of NAT and Firewall rules at a basic level, though please correct me if I'm wrong at any point. I've seen many products list their firewall requirements ...
- 213
2
votes
1
answer
1k
views
Firewall and VPN functionalities for a Cisco ISR4321 V/K9
I would like to know if I can setup ACLs with the access-list command with a Cisco ISR4321 V/K9.
Are there restrictions (in comparison with a Cisco ISR4321 VSEC/K9)?
Note the SEC part in the reference....
- 399
2
votes
1
answer
106
views
Cisco port ACL for one IP
I'm running cisco WS-C4948-10GE (MPC8540) and having a vlan configured as following:
ip address 192.168.1.1 255.255.255.248
My question is, How to create an ACL to limit the connections for ports 80 ...
2
votes
2
answers
209
views
ACL on virtual interface get ignored
Good evening!
Recently i've got some problem in configuring cisco router (IOS 12.x). There is an virtual interface for a vlan:
interface GigabitEthernet0/1.203
description Department XXX
...
- 131
2
votes
2
answers
193
views
Simple ACL question
I'm still new to networking and have a question or problem I need to solve, but I'm not sure how to move forward. I need to stop PC0 from Vlan10 from talking to PC5 in Vlan30, but he must be able to ...
- 63
2
votes
2
answers
4k
views
Cisco router - deny access to host on port 8080, allow on 80
I'm designing a network with the following scheme:
I have 5 vlans, 3 on S1 and 2 on S3. I'm currently concerned with making access list. Each vlan has a web server that is configured to listen on ...
- 123