Questions tagged [acl]
Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)
228 questions
0
votes
1
answer
6k
views
Restricted Server Access to Specific VLAN via ACL [closed]
I want to allow a specific VLAN to a specific server. LAN users should be able to access every server, but VPN users should able to only access a specific server.
Suppose User A (VPN user) comes onto ...
- 101
4
votes
1
answer
719
views
Block port with single exception on Cisco 803
This seems fairly straight forward, though I'm having trouble finding a solution on Google and in the Cisco documentation. I think I'm perhaps just not looking for the correct thing.
Essentially I ...
- 175
4
votes
1
answer
3k
views
How can I add ACL entry comments on a Cisco 3750?
I'm trying to find the best way to add comments into my access-lists. For the moment, the only manner I found is the following one:
switch#conf t
switch(config)#ip access-list extended VLAN-TEST3
...
- 43
5
votes
2
answers
256
views
Extended ACL bandwidth consumption
While preparing for CCNA exam, I found this recommendation in a book:
Place extended ACLs as close as possible to the source of the packets that will be filtered. Filtering close to the source of ...
user5029
2
votes
1
answer
330
views
Access Control Cisco ASA 5510
I have a Cisco ASA 5510 on 8.2(5).
NATing works fine but where my issues is that it seems the only way to get traffic through from outside-->inside is through a "any any ip" rule which I don't want. ...
- 157
5
votes
1
answer
1k
views
ACL on entry of Core Switch - Performance doubt
We are an ISP and I would like to implement ACL to protect our core network (Infrastructure) and implement some filtering on public subnet inside.
As border device we have a cisco WS-C4500X-32 4500x ...
- 2,008
7
votes
3
answers
7k
views
Edit Cisco IOS ACL without hanging the router
I have a Cisco Router 1941 Series and I want to make some changes to the access-list on the router. I got to know I will have to delete one of the list and then re-add everything again with my ...
- 569
2
votes
1
answer
921
views
Standard IP ACL inbound direction
The command syntax format of a standard ACL is
access-list access-list-number {permit|deny} {host|source source-wildcard|any}.
This is an example of the use of a standard ACL in order to block all ...
- 23
3
votes
1
answer
233
views
Apply an extended ACL on Cisco 7609 SIP-400
Good morning,
I have configured a pbr to apply it to a virtual-template
here is my route-map definition :
route-map to_virtual_template permit 10
match ip address 101
set ip next-hop X.X.X.1
...
- 501
4
votes
1
answer
636
views
Reflexive ACL Limitations
Reflexive ACLs can monitor outbound traffic and create a temporary ACL that mirrors this traffic by swapping the source/destination addresses and port #s:
OUTBOUND: 192.168.1.2:1234 ->...
- 666
9
votes
2
answers
4k
views
Are IPv6 Wildcard Matches in Cisco IOS Possible?
Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
3
votes
2
answers
11k
views
How to decipher dropped packet from packet-tracer output?
I have a massive ACL that i'm dealing with and I can't seem to find what line is blocking me. Is there a way for packet-tracer to help me figure out more specifically where i'm getting blocked at?
...
- 754
6
votes
2
answers
6k
views
Change Ping Response for Traffic Blocked by Access Control List
I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1.
I have created the ACL:
R1(config)#access-list 1
R1(config)#Deny 20.1.1.1
R1(config)#Permit any
R1(config)# int s0/0
R1(config-if)#ip ...
- 153
3
votes
2
answers
1k
views
IP addrs Outside of DHCP range blocked by Cisco ASA 5505
My issue is this: I have a Cisco ASA which the INSIDE interface is set to DHCP lease IPs 10.1.10.104 - 254 ... I have a few static servers using the "lower" IP range (i.e. 10.1.10.11). The issue ...
- 463
6
votes
1
answer
6k
views
Cisco ASA: which side is "inside" with same security-level?
I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like:
Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
- 355
6
votes
1
answer
15k
views
How to use tcp-udp objects in a single ACL?
I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
- 3,310
4
votes
2
answers
836
views
The Difference Between ACL and FPM
What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
- 43
6
votes
1
answer
438
views
Is it possible to have ranges in two octets in an ACL / object-group
I'm trying to find out if there is a "clean" way to do this.
I need to setup a ACL on a FWSM that effects devices over multiple subnets.
The structure looks like this:
10.10.1-254.1-15
I could do:
...
- 754
0
votes
2
answers
6k
views
Block ICMP ping from a PC to a PC
I have a topology like this
PC1 ------Switch
PC2 ------Layer --------- Router
PC3-------two
PC1 192.168.1.34 VLAN 10.
PC2 192.168.1.50 VLAN 20.
PC3 192.168.1.51 VLAN 20.
I configured a router on ...
- 73
14
votes
2
answers
2k
views
BGP regular expression .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+
could anyone tell me what ip as-path access-list 100 deny .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+ stands for?!
I searched over the internet for the meaning of this regular expression, but I was unable to ...
- 275
15
votes
4
answers
39k
views
Finding IP Addresses for Social Network Sites
How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
- 253
18
votes
7
answers
68k
views
Cisco command to show which interfaces an ACL is applied to
For Cisco routers and switches, is there a show command, or something similar, that will display what physical and logical interfaces an ACL is implemented on and what direction it is applied in?
I ...
- 3,129
7
votes
2
answers
4k
views
How to configure OOB access via IP
Single Cisco IOS device in a remote DC, I have an OOB connection delivered into the rack (length of Cat5e into my rack from another onsite providers rack, who have diverse routes from my own, in and ...
- 5,310
6
votes
1
answer
26k
views
What is the difference between "permit tcp any any eq telnet" and "permit tcp any eq telnet any"?
I'm a CCNA student and during a LAB I found that for some rules on an incoming extended ACL using a rule like permit tcp any any eq (protocol) would work fine while on other rules I needed to use the ...
- 267
6
votes
1
answer
684
views
Can I use a reflexive ACL in place of a Firewall?
I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall.
This was a LAB router that I would like to set ...
- 267
5
votes
2
answers
3k
views
Brocade MLX reapplying modified ACL
Why do Brocade MLX ACL changes require the extra configuration step as described below? Compared to Cisco ACLs this seems inconvenient.
If you make an ACL configuration change, you must reapply the ...
- 3,129
10
votes
3
answers
15k
views
Cisco: prevent vlan's of communicating with eachother on cisco router (ACL alternative)
Setup: Cisco router with multiple VLAN's configured on it.
How can you prevent 2 VLAN's communicating with eachother? Normally I would do this with ACL's like this:
access-list 102 deny ip 1.1.1.0 0....
- 2,393
23
votes
7
answers
41k
views
Difference between access list and prefix list?
Can someone explain with an example whats the difference between an access list and prefix list.
- 545