Questions tagged [acl]
Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)
228 questions
23
votes
7
answers
41k
views
Difference between access list and prefix list?
Can someone explain with an example whats the difference between an access list and prefix list.
- 545
18
votes
7
answers
68k
views
Cisco command to show which interfaces an ACL is applied to
For Cisco routers and switches, is there a show command, or something similar, that will display what physical and logical interfaces an ACL is implemented on and what direction it is applied in?
I ...
- 3,129
15
votes
4
answers
39k
views
Finding IP Addresses for Social Network Sites
How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
- 253
14
votes
2
answers
2k
views
BGP regular expression .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+
could anyone tell me what ip as-path access-list 100 deny .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+ stands for?!
I searched over the internet for the meaning of this regular expression, but I was unable to ...
- 275
10
votes
3
answers
15k
views
Cisco: prevent vlan's of communicating with eachother on cisco router (ACL alternative)
Setup: Cisco router with multiple VLAN's configured on it.
How can you prevent 2 VLAN's communicating with eachother? Normally I would do this with ACL's like this:
access-list 102 deny ip 1.1.1.0 0....
- 2,393
9
votes
4
answers
28k
views
Access-Lists and VLAN and understanding traffic flow
I have a question that I am having a very hard time wrapping my mind around, and I think you might be able to square me away.
When applying an access list to a VLAN interface (VLAN 32) in a L3 switch,...
- 463
9
votes
2
answers
4k
views
Are IPv6 Wildcard Matches in Cisco IOS Possible?
Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
9
votes
1
answer
1k
views
What do the parentheses "()" after objects mean in Cisco ASA ACLs?
I have encountered something I'm not familiar with in a customer's configuration, I know that the "(hitcnt=324165)" at the end of every rule in "show access-list" points to rule usage, hit count. But ...
- 433
8
votes
1
answer
2k
views
Unusual wildcard mask in Cisco ACL configuration
I inherited some configs on a network I manage from a previous administrator.
In some of the ACLs there are some very strange wildcard masks that i've not seen before, for example:
10 permit ip any ...
- 83
7
votes
3
answers
7k
views
Edit Cisco IOS ACL without hanging the router
I have a Cisco Router 1941 Series and I want to make some changes to the access-list on the router. I got to know I will have to delete one of the list and then re-add everything again with my ...
- 569
7
votes
2
answers
7k
views
HP Procurve 5406zl - ACL issue
I'm having an issue with an ACL on a VLAN interface. I've followed HP's documentation here:
http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02609963-3.pdf
I want to do the following:
VLAN 101 ...
- 737
7
votes
2
answers
4k
views
How to configure OOB access via IP
Single Cisco IOS device in a remote DC, I have an OOB connection delivered into the rack (length of Cat5e into my rack from another onsite providers rack, who have diverse routes from my own, in and ...
- 5,310
6
votes
1
answer
26k
views
What is the difference between "permit tcp any any eq telnet" and "permit tcp any eq telnet any"?
I'm a CCNA student and during a LAB I found that for some rules on an incoming extended ACL using a rule like permit tcp any any eq (protocol) would work fine while on other rules I needed to use the ...
- 267
6
votes
2
answers
6k
views
Change Ping Response for Traffic Blocked by Access Control List
I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1.
I have created the ACL:
R1(config)#access-list 1
R1(config)#Deny 20.1.1.1
R1(config)#Permit any
R1(config)# int s0/0
R1(config-if)#ip ...
- 153
6
votes
1
answer
684
views
Can I use a reflexive ACL in place of a Firewall?
I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall.
This was a LAB router that I would like to set ...
- 267
6
votes
3
answers
457
views
Cisco ASA 5510 - ACL Config Question
My company's email server is under attack from the following IP address blocks
92.63.193.0
5.188.9.0
Here are the corresponding WHOIS records for each network
% This is the RIPE Database query ...
- 243
6
votes
1
answer
15k
views
How to use tcp-udp objects in a single ACL?
I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
- 3,310
6
votes
1
answer
438
views
Is it possible to have ranges in two octets in an ACL / object-group
I'm trying to find out if there is a "clean" way to do this.
I need to setup a ACL on a FWSM that effects devices over multiple subnets.
The structure looks like this:
10.10.1-254.1-15
I could do:
...
- 754
6
votes
1
answer
6k
views
Cisco ASA: which side is "inside" with same security-level?
I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like:
Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
- 355
5
votes
3
answers
5k
views
Difference between firewall and ACL
I have found many answers to this question, none of which satisfy me due to lack of detail.
Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
- 151
5
votes
2
answers
256
views
Extended ACL bandwidth consumption
While preparing for CCNA exam, I found this recommendation in a book:
Place extended ACLs as close as possible to the source of the packets that will be filtered. Filtering close to the source of ...
user5029
5
votes
1
answer
740
views
Nexus 7010 ACL Error
IS_NEXUS_7010(config)# interface Ethernet2/2
IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24
IS_NEXUS_7010(config-if)# switchport trunk allowed vlan 1-14
IS_NEXUS_7010(config-...
- 51
5
votes
1
answer
1k
views
ACL on entry of Core Switch - Performance doubt
We are an ISP and I would like to implement ACL to protect our core network (Infrastructure) and implement some filtering on public subnet inside.
As border device we have a cisco WS-C4500X-32 4500x ...
- 2,008
5
votes
2
answers
549
views
Cisco Catalyst ACL one-way initiated traffic
i am trying to setup ACL on my core router, i have the following networks:
Data (192.168.32.0/24)
Voice (192.168.42.0/24)
Guest (192.168.100.0/24)
QA (192.168.101.0/24)
I would like the following ...
- 155
5
votes
1
answer
11k
views
HP V1910, VLAN routing - what did I miss?
First time posting in this part of stack exchange and I'm a novice regarding advanced network configuration - plug & play switch installation I can handle ;o)
I got myself a HP V1910-48G (former ...
- 215
5
votes
2
answers
2k
views
Cisco ASA acl deny hit rule but traffic permitted
interface "ldap"
access-group ldap_access_in in interface ldap
access-group ldap_access_out out interface ldap
I had zero hits until I started to try ssh;
access-list ldap_access_out line 1 ...
- 93
5
votes
2
answers
3k
views
Brocade MLX reapplying modified ACL
Why do Brocade MLX ACL changes require the extra configuration step as described below? Compared to Cisco ACLs this seems inconvenient.
If you make an ACL configuration change, you must reapply the ...
- 3,129
5
votes
1
answer
2k
views
ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files
I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated:
The Issue: I have set a new backup server and I want to back up data from ...
- 167
4
votes
1
answer
8k
views
ACL Question. access-list permit ip any any
so quick question, in the ACL bellow, Would "permit ip any any" allow ICMP packet to traverse the router? Or is "permit ip any any" in the ACL only referring to allowing any layer 3 address from ...
- 43
4
votes
1
answer
893
views
Correct ACL rules to isolate WiFi traffic from other VLANs?
I have written ACL rules written for a Dell PowerConnect 8024F (which, for the most part, uses the Cisco ACL "language") to isolate WiFi traffic from the rest of the network but allow the ...
- 176
4
votes
1
answer
4k
views
Cisco Nexus 9300 TCAM carving
I have Cisco Nexus C9396PX L3 switch and i have configured bunch of ACL (inbound) on it to deny/permit traffic. now if i am trying to add more ACL then getting error that your TCAM table is full. here ...
- 4,389
4
votes
2
answers
836
views
The Difference Between ACL and FPM
What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
- 43
4
votes
1
answer
719
views
Block port with single exception on Cisco 803
This seems fairly straight forward, though I'm having trouble finding a solution on Google and in the Cisco documentation. I think I'm perhaps just not looking for the correct thing.
Essentially I ...
- 175
4
votes
1
answer
3k
views
How can I add ACL entry comments on a Cisco 3750?
I'm trying to find the best way to add comments into my access-lists. For the moment, the only manner I found is the following one:
switch#conf t
switch(config)#ip access-list extended VLAN-TEST3
...
- 43
4
votes
1
answer
3k
views
Help with VLANs, ACLs, DHCP on SG-300 Layer 3 switch
I have to do the following configuration on an cisco Sg-300 small business L3 switch as in the figure.
Since i don’t have access to this switche for practice before doing this live in production i ...
- 394
4
votes
1
answer
2k
views
Cisco ACL to block connections with ICMP or RST
The Cisco "deny" ACL seems to quietly drop TCP/IP packets. Is it possible for it to send either ICMP responses or TCP RST's in response to a denied request?
- 77
4
votes
1
answer
636
views
Reflexive ACL Limitations
Reflexive ACLs can monitor outbound traffic and create a temporary ACL that mirrors this traffic by swapping the source/destination addresses and port #s:
OUTBOUND: 192.168.1.2:1234 ->...
- 666
4
votes
1
answer
416
views
MAC ACL to prevent access to unauthorized computers
My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...
- 41
4
votes
1
answer
822
views
Cisco ASA NAT/ACL issues across EZVPN
I have an EZVPN running between two locations, Location A has a 5520 and is the EZVPN server, Location B has a 5506 and is a EZVPN client. Currently I'm trying to set NAT and ACL(s) so that hosts on ...
- 71
4
votes
0
answers
941
views
TCAM utilization on Nexus 9396 switches
I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic.
I am reading about TCAM and wanted to ...
- 4,389
3
votes
3
answers
2k
views
How to add multiple ip address in destination ip in acl rule
Iam trying to block a certain host from sending any message to any host in the network
is there is a way to do that or i have to deny host by host ?
3
votes
2
answers
3k
views
Why "Deny all" statement in ACL is not working?
I want to block Host 192.168.1.1 from reaching 192.168.2.0/24 network and in order to implement that I've applied Extended ACL "ACL_FOR_R2" on R2's serial2/0 interface. Now as we all know that at the ...
- 347
3
votes
1
answer
312
views
Cisco ACL numbering
This is a small technical question. I can't seem to find any information on this, so I thought I'd ask here.
I'm currently studying for my CCNA and I'm currently on the topic of ACLs. On IOS standard ...
- 133
3
votes
1
answer
929
views
delete object network in cisco ASA with packet tracert
I used 5506 as firewall and I am trying to delete object network I created and it gives error as ERROR: unable to delete the object configuration. object (inside-net-obj) is being used.
commands I ...
- 153
3
votes
2
answers
5k
views
hpe 5700 (comware 7) vlan routing
I want to divide my network into smaller segments.
I want to use our HPE FF 5700-40XG-2QSFP+ switch as the router.
It runs comware 7.
VLAN 101 for servers, using 10.101.0.0/16, interface ip 10.101.1....
- 61
3
votes
1
answer
104
views
Could adding new systems to the network suddenly block access to the internet if Access Lists are unchanged?
Follow up to this Q&A.
Documentation regarding IP Access Lists is read to understand how this works and include or exclude it as a possible cause that some systems were suddenly not able to ...
- 553
3
votes
1
answer
187
views
Access control on Cisco router with switchports?
I am working with a series 800 router which has inbuilt switchports.
I want to use 2 switchports for a VLAN (say VLAN 100).
On one port will have devices:
192.168.1.10
192.168.1.30
Connected to ...
- 583
3
votes
2
answers
290
views
Network ACLs vs File System ACLs
Debate arose recently from a Systems [Windows] engineer over the more logical application in his opionion of File System ACLs vs how Network ACLs work.
Network ACLs generally work by applying ACEs in ...
- 7,134
3
votes
1
answer
2k
views
L3 and L2 interfaces in ACL
What is L3 and L2 interfaces in ACL feature
and why ethernet access-lists will not support L3 interfaces
- 31
3
votes
2
answers
5k
views
Cisco Port ACL Rule blocking port 80 appears to block all traffic
I have an ACL configured on an EHWIC card in a 2911 ISR, IOS 15.4, as below.
If I have the rules for blocking port 80 in there, ALL traffic to that port appears to be blocked (SSH, telnet, RDP etc.)
...
- 31