Questions tagged [acl]
Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)
18 questions with no upvoted or accepted answers
4
votes
0
answers
941
views
TCAM utilization on Nexus 9396 switches
I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic.
I am reading about TCAM and wanted to ...
- 4,389
2
votes
2
answers
372
views
Nat ACL Question?
I am so confused with fundamentals that I used to be an expert in,
so I have this topology
Please answer to my questions separately,
Question 1) So if I have two DNS severs, and ofc two IP address(81....
- 39
2
votes
1
answer
991
views
DMVPN EIGRP routes not passing
I am having a problem with a DMVPN tunnel I recently created. I have done some torubleshooting on this and discovered the tunnel to be up between both sites, but they are not passing any traffic ...
- 21
2
votes
1
answer
355
views
Allow outgoing connections
I have an Arista switch (EOS) and I'm having trouble allowing outgoing connection from the switch to the outside. Using tcpdump I can see that no packets are being allowed. This has an impact on DNS ...
anon
1
vote
0
answers
108
views
TACACS Through ASA L2L Tunnel
Hello see below network diagram.
I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
- 171
1
vote
1
answer
197
views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
1
vote
1
answer
602
views
How to block telnet access for one particular network from all networks except one using Extended ACL
Scenerio is given in the picture. I want to block all the networks except 192.168.5.128/25 from doing telnet of 192.168.5.0/25.
- 21
1
vote
0
answers
147
views
Access-class in denies telnet under specific configuration
So I created an Access-list to permit telnet from a specific subnet. Here is the network diagram.
I originally tried permitting the subnet 10.1.1.0 /24 to access the R4 vty lines 0 4. It was a ...
- 69
1
vote
0
answers
282
views
Block internet on a Cisco catalyst 3560 port
Good day
Is there a way to block a specific port in a Cisco Catalyst 3560 switch to block the user from accessing the internet but still have full access to the internal corporate resources. The ...
- 11
1
vote
0
answers
167
views
VACL Matching on EtherType
I was attempting to use a VACL to block intra-VLAN traffic. The VACL was matching a MACL that specified an EtherType to block. I applied the VACL to a VLAN, and then plugged two PCs into the switch in ...
- 11
1
vote
0
answers
300
views
After VPN, only three PCs can ping 8.8.8.8
We took on a client with a really old 2811, with a mess of a config file. We brought up a new IPsec tunnel to us. The tunnel works great, however, now only three computers can ping to 8.8.8.8, the ...
- 11
1
vote
0
answers
220
views
NAT is not working because of ACL and CLI command unavailable
I have configured ACL for NAT and PFR purpose.
ios c1841-adventerprisek9-mz.151-4.M4.bin
ip access-list extended PFR
permit ip 192.168.0.0 0.0.7.255 any log
route-map isp2 permit 10
match ip ...
- 21
0
votes
1
answer
79
views
How to combine port forwarding and NAT/PAT on Cisco router?
I have a problem, that I cannot bring together working PAT and Port forwarding on a Cisco router.
Here is my topology:
Explanation to topology:
Start connection sourced by 192.168.1.1 with ...
- 1
0
votes
0
answers
27
views
SONiC OS. ACL for ip of vlan interface L3
I'm trying to apply simple acl rules to IP address vlan100, but it always responds to ping.
"VLAN100_ACL": {
"policy_desc": "VLAN100 Ingress ACL",
"type": &...
- 1
0
votes
2
answers
199
views
Cisco ASA access-lists and net config
Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0
votes
0
answers
245
views
Allow one way SSH on extended IP access list on Cisco switch
interface GigabitEthernet1/0/11
ip access-group VM01-BLOCK-SSH-ACCESS-OUT out
objective:
10.10.10.104 -x-> any 10.10.10.0/24 via SSH
any 10.10.10.0/24 via SSH ---> 10.10.10.104
Question: ...
- 526
0
votes
0
answers
380
views
Juniper MX Routing Engine Firewall Filter
I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
- 157
0
votes
1
answer
395
views
Ping reply is slow after applying inbound ACL
I applied inbound ACL to block ping request from host IP to host IP. The effect after that is ping reply from unblocked IP on the interface that has been applied the inbound ACL is slow/loss.
Any ...
- 89