Questions tagged [acl]

Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)

Filter by
Sorted by
Tagged with
21
votes
7answers
38k views

Difference between access list and prefix list?

Can someone explain with an example whats the difference between an access list and prefix list.
18
votes
7answers
60k views

Cisco command to show which interfaces an ACL is applied to

For Cisco routers and switches, is there a show command, or something similar, that will display what physical and logical interfaces an ACL is implemented on and what direction it is applied in? I ...
15
votes
4answers
36k views

Finding IP Addresses for Social Network Sites

How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
14
votes
2answers
2k views

BGP regular expression .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+

could anyone tell me what ip as-path access-list 100 deny .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+ stands for?! I searched over the internet for the meaning of this regular expression, but I was unable to ...
10
votes
3answers
15k views

Cisco: prevent vlan's of communicating with eachother on cisco router (ACL alternative)

Setup: Cisco router with multiple VLAN's configured on it. How can you prevent 2 VLAN's communicating with eachother? Normally I would do this with ACL's like this: access-list 102 deny ip 1.1.1.0 0....
9
votes
2answers
3k views

Are IPv6 Wildcard Matches in Cisco IOS Possible?

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
9
votes
1answer
916 views

What do the parentheses "()" after objects mean in Cisco ASA ACLs?

I have encountered something I'm not familiar with in a customer's configuration, I know that the "(hitcnt=324165)" at the end of every rule in "show access-list" points to rule usage, hit count. But ...
8
votes
1answer
2k views

Unusual wildcard mask in Cisco ACL configuration

I inherited some configs on a network I manage from a previous administrator. In some of the ACLs there are some very strange wildcard masks that i've not seen before, for example: 10 permit ip any ...
7
votes
3answers
6k views

Edit Cisco IOS ACL without hanging the router

I have a Cisco Router 1941 Series and I want to make some changes to the access-list on the router. I got to know I will have to delete one of the list and then re-add everything again with my ...
7
votes
4answers
23k views

Access-Lists and VLAN and understanding traffic flow

I have a question that I am having a very hard time wrapping my mind around, and I think you might be able to square me away. When applying an access list to a VLAN interface (VLAN 32) in a L3 switch,...
7
votes
2answers
6k views

HP Procurve 5406zl - ACL issue

I'm having an issue with an ACL on a VLAN interface. I've followed HP's documentation here: http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02609963-3.pdf I want to do the following: VLAN 101 ...
7
votes
2answers
4k views

How to configure OOB access via IP

Single Cisco IOS device in a remote DC, I have an OOB connection delivered into the rack (length of Cat5e into my rack from another onsite providers rack, who have diverse routes from my own, in and ...
6
votes
1answer
21k views

What is the difference between "permit tcp any any eq telnet" and "permit tcp any eq telnet any"?

I'm a CCNA student and during a LAB I found that for some rules on an incoming extended ACL using a rule like permit tcp any any eq (protocol) would work fine while on other rules I needed to use the ...
6
votes
2answers
5k views

Change Ping Response for Traffic Blocked by Access Control List

I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1. I have created the ACL: R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip ...
6
votes
1answer
571 views

Can I use a reflexive ACL in place of a Firewall?

I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall. This was a LAB router that I would like to set ...
6
votes
3answers
385 views

Cisco ASA 5510 - ACL Config Question

My company's email server is under attack from the following IP address blocks 92.63.193.0 5.188.9.0 Here are the corresponding WHOIS records for each network % This is the RIPE Database query ...
6
votes
1answer
14k views

How to use tcp-udp objects in a single ACL?

I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
6
votes
1answer
410 views

Is it possible to have ranges in two octets in an ACL / object-group

I'm trying to find out if there is a "clean" way to do this. I need to setup a ACL on a FWSM that effects devices over multiple subnets. The structure looks like this: 10.10.1-254.1-15 I could do: ...
6
votes
1answer
5k views

Cisco ASA: which side is "inside" with same security-level?

I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like: Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
5
votes
2answers
235 views

Extended ACL bandwidth consumption

While preparing for CCNA exam, I found this recommendation in a book: Place extended ACLs as close as possible to the source of the packets that will be filtered. Filtering close to the source of ...
5
votes
1answer
621 views

Nexus 7010 ACL Error

IS_NEXUS_7010(config)# interface Ethernet2/2 IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24 IS_NEXUS_7010(config-if)# switchport trunk allowed vlan 1-14 IS_NEXUS_7010(config-...
5
votes
1answer
1k views

ACL on entry of Core Switch - Performance doubt

We are an ISP and I would like to implement ACL to protect our core network (Infrastructure) and implement some filtering on public subnet inside. As border device we have a cisco WS-C4500X-32 4500x ...
5
votes
2answers
388 views

Cisco Catalyst ACL one-way initiated traffic

i am trying to setup ACL on my core router, i have the following networks: Data (192.168.32.0/24) Voice (192.168.42.0/24) Guest (192.168.100.0/24) QA (192.168.101.0/24) I would like the following ...
5
votes
1answer
11k views

HP V1910, VLAN routing - what did I miss?

First time posting in this part of stack exchange and I'm a novice regarding advanced network configuration - plug & play switch installation I can handle ;o) I got myself a HP V1910-48G (former ...
5
votes
2answers
2k views

Cisco ASA acl deny hit rule but traffic permitted

interface "ldap" access-group ldap_access_in in interface ldap access-group ldap_access_out out interface ldap I had zero hits until I started to try ssh; access-list ldap_access_out line 1 ...
5
votes
2answers
3k views

Brocade MLX reapplying modified ACL

Why do Brocade MLX ACL changes require the extra configuration step as described below? Compared to Cisco ACLs this seems inconvenient. If you make an ACL configuration change, you must reapply the ...
5
votes
1answer
2k views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
4
votes
1answer
7k views

ACL Question. access-list permit ip any any

so quick question, in the ACL bellow, Would "permit ip any any" allow ICMP packet to traverse the router? Or is "permit ip any any" in the ACL only referring to allowing any layer 3 address from ...
4
votes
1answer
164 views

Correct ACL rules to isolate WiFi traffic from other VLANs?

I have written ACL rules written for a Dell PowerConnect 8024F (which, for the most part, uses the Cisco ACL "language") to isolate WiFi traffic from the rest of the network but allow the ...
4
votes
1answer
1k views

Cisco Nexus 9300 TCAM carving

I have Cisco Nexus C9396PX L3 switch and i have configured bunch of ACL (inbound) on it to deny/permit traffic. now if i am trying to add more ACL then getting error that your TCAM table is full. here ...
4
votes
2answers
791 views

The Difference Between ACL and FPM

What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
4
votes
1answer
706 views

Block port with single exception on Cisco 803

This seems fairly straight forward, though I'm having trouble finding a solution on Google and in the Cisco documentation. I think I'm perhaps just not looking for the correct thing. Essentially I ...
4
votes
1answer
3k views

How can I add ACL entry comments on a Cisco 3750?

I'm trying to find the best way to add comments into my access-lists. For the moment, the only manner I found is the following one: switch#conf t switch(config)#ip access-list extended VLAN-TEST3 ...
4
votes
1answer
3k views

Help with VLANs, ACLs, DHCP on SG-300 Layer 3 switch

I have to do the following configuration on an cisco Sg-300 small business L3 switch as in the figure. Since i don’t have access to this switche for practice before doing this live in production i ...
4
votes
1answer
582 views

Reflexive ACL Limitations

Reflexive ACLs can monitor outbound traffic and create a temporary ACL that mirrors this traffic by swapping the source/destination addresses and port #s: OUTBOUND: 192.168.1.2:1234 ->...
4
votes
1answer
304 views

MAC ACL to prevent access to unauthorized computers

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...
4
votes
1answer
785 views

Cisco ASA NAT/ACL issues across EZVPN

I have an EZVPN running between two locations, Location A has a 5520 and is the EZVPN server, Location B has a 5506 and is a EZVPN client. Currently I'm trying to set NAT and ACL(s) so that hosts on ...
3
votes
3answers
866 views

How to add multiple ip address in destination ip in acl rule

Iam trying to block a certain host from sending any message to any host in the network is there is a way to do that or i have to deny host by host ?
3
votes
2answers
2k views

Why "Deny all" statement in ACL is not working?

I want to block Host 192.168.1.1 from reaching 192.168.2.0/24 network and in order to implement that I've applied Extended ACL "ACL_FOR_R2" on R2's serial2/0 interface. Now as we all know that at the ...
3
votes
1answer
238 views

Cisco ACL numbering

This is a small technical question. I can't seem to find any information on this, so I thought I'd ask here. I'm currently studying for my CCNA and I'm currently on the topic of ACLs. On IOS standard ...
3
votes
2answers
4k views

hpe 5700 (comware 7) vlan routing

I want to divide my network into smaller segments. I want to use our HPE FF 5700-40XG-2QSFP+ switch as the router. It runs comware 7. VLAN 101 for servers, using 10.101.0.0/16, interface ip 10.101.1....
3
votes
1answer
100 views

Could adding new systems to the network suddenly block access to the internet if Access Lists are unchanged?

Follow up to this Q&A. Documentation regarding IP Access Lists is read to understand how this works and include or exclude it as a possible cause that some systems were suddenly not able to ...
3
votes
1answer
180 views

Access control on Cisco router with switchports?

I am working with a series 800 router which has inbuilt switchports. I want to use 2 switchports for a VLAN (say VLAN 100). On one port will have devices: 192.168.1.10 192.168.1.30 Connected to ...
3
votes
2answers
209 views

Network ACLs vs File System ACLs

Debate arose recently from a Systems [Windows] engineer over the more logical application in his opionion of File System ACLs vs how Network ACLs work. Network ACLs generally work by applying ACEs in ...
3
votes
1answer
935 views

L3 and L2 interfaces in ACL

What is L3 and L2 interfaces in ACL feature and why ethernet access-lists will not support L3 interfaces
3
votes
2answers
3k views

Cisco Port ACL Rule blocking port 80 appears to block all traffic

I have an ACL configured on an EHWIC card in a 2911 ISR, IOS 15.4, as below. If I have the rules for blocking port 80 in there, ALL traffic to that port appears to be blocked (SSH, telnet, RDP etc.) ...
3
votes
1answer
155 views

How to permit behaviour in Cisco access-list commands?

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
3
votes
2answers
4k views

Configuring DMZ in ASA

I am fairly new to the ASA world. Basically I have exhausted all my search options, and turning to experts here for help. I have an ASA 5506-X with 4 interfaces. ASA is running OS 9.4(2) and I am ...
3
votes
1answer
1k views

Allowing only routed traffic, block intra-VLAN forwarding

In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*. There ...
3
votes
1answer
78 views

I can't connect to a denied network in Packet Tracer

I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping ...

1
2 3 4 5