7 votes
Accepted

Is the root user on juniper switches useful?

Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly. The biggest practical example I can ...
user avatar
  • 6,440
5 votes
Accepted

Multiple access lists on same vlan

You can't have more than one access list per direction on an interface. So, to accomplish this, you will have to create a unique access-list for each interface that allows only the traffic you want.
user avatar
  • 62.4k
5 votes
Accepted

Is this extended acl valid?

The any eq 80 filters for the source port - applying that to a HTTP client makes it near impossible to connect to the server. HTTP clients use ephemeral source ports (49152-65535). Since you don't ...
user avatar
  • 70.5k
4 votes

Is the root user on juniper switches useful?

The root user for any *nix platform is capable of performing any functions on the system they want - and I mean anything. I'd suggest you look into a wiki article on this as it is a little beyond the ...
user avatar
  • 5,449
4 votes

Cisco ACL not working as expected

There is an implicit "deny" at the end of every access-list. So your current access-list actually says: access-list 111 deny udp (insert client ip) any eq 137 access-list 111 permit udp any any ...
user avatar
  • 1,899
4 votes
Accepted

Whether we usual use dot-decimal notation to represent network or IP by opposite mask?

As far as I know, the only thing which uses the "opposite mask" are the "wildcard bits" of access control lists in Cisco equipment. These can represent hosts or networks (and portions or aggregations ...
user avatar
  • 15.9k
4 votes

How do I block IPs on my network?

You need to set up 802.1X, that way you can guarantee that users are strongly authenticated before accessing the company Wifi. Use RADIUS or if it's a small network you can get by with the built-in ...
user avatar
  • 2,229
4 votes

Why my simple standard ACL outbound doesn't block the gateway's traffic/ping of the VLAN's SVI?

You can still ping the router IP because the ACL is only applied to traffic passing through the interface and not to the interface itself. Well if you want to make it as described, you'll have to do ...
user avatar
  • 1,700
3 votes
Accepted

Access-list won't show all hit matches

If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, ...
user avatar
3 votes
Accepted

Extended access list conflict condition will it cause override?

Access lists work on a first-match basis. The traffic will be compared to the list, starting with the first statement in the list. As soon as a match is found, then the router exits the list.
user avatar
  • 93.5k
3 votes
Accepted

ip ssh source-interface vlan - allow ssh from specific vlan not working

You are using the wrong command. ip ssh source-interface command defines the source IP when starting an SSH session from the router. It has no effect on other traffic. To control who can SSH into ...
user avatar
  • 62.4k
3 votes

Access Control List from a network to a specific device on another network.

You are confusing routing with traffic flow. The routing protocol is used to learn networks from other routers. It does not directly affect the flow of traffic. If you want to block access to the ...
user avatar
  • 62.4k
3 votes

For ethernet with bandwidth B, how much time a node has to wait before sensing the channel after the first collision detected?

Nodes back off a random amount of time after a collision before trying to transmit. This prevents all the nodes from trying to transmit at the same time after a collision, causing another collision.
user avatar
  • 93.5k
3 votes

Standard access list

Standard access lists filter on source addresses. So ACL 20 only allows packets whose source IP is 192.168.20.x. But Vlan 10 is a different subnet, so any packet from VLAN 10 is dropped. When you ...
user avatar
  • 62.4k
3 votes
Accepted

Router Extended Access Control List

You can place an extended ACL where you want (as long as it is in the path of the packet you want to filter of course). However, depending on the filtering parameters, it is usually better to put it ...
user avatar
  • 861
3 votes
Accepted

How is P actually chosen in P-persistent CSMA?

So, this question actually asks two question: how to find the optimal value of p. given a value of p, how to set this value of p on any participating system. For the first question: I would say that ...
user avatar
  • 1,310
2 votes

Networking, dedicating bandwidth to specific networks

There are lots of ways to use Cisco routers with advanced routing features that can do what you are looking to do. They all fall under "Quality of Service," or QoS for short. Cisco routers can ...
user avatar
  • 121
2 votes
Accepted

Cisco VPN Clients Routing Over IPSec VPN - ACL?

Obviously you aren't using a Cisco VPN client, as it monitors the route table and will remove your tampering immediately. Even if the routes stick, the ASA will ignore traffic that doesn't belong in ...
user avatar
  • 29.6k
2 votes

Limiting community member communication in PVLAN's

Private VLANS are a layer 2 technology. To filter specific ports, you need something that operates at layer 4. There are virtualized firewalls that would be applied per VM that could do this for you....
user avatar
  • 62.4k
2 votes

Access Control List from a network to a specific device on another network.

You want to deny IP packets from that network. Update the first line of your ACL to read access-list 106 deny ip 192.168.3.0 0.0.0.31 host Server and you should be good. The fact that OSPF is your ...
user avatar
  • 1,470
2 votes

Multiple access and full/half duplex point-to-point links

Shared physical media: only one device on the shared media can access it at any given time, the rest has to wait. Halfduplex point to point links, uses the same physical media in both directions. It ...
user avatar
  • 1,397
2 votes
Accepted

Open up port for one IP

If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming ...
user avatar
  • 93.5k
2 votes
Accepted

Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL

Thank you both for your input. I removed the global nat pool for xx.xx.xx.219, moved the web server being hosted at xx.xx.xx.218 to 219, and changed the webvpn port to 443 for standard https on 218. ...
user avatar
  • 51
2 votes

Access Control Permissions

Access control lists operate at layers 3 and 4 of the OSI or TCP/IP model. File operations like reading and writing are application layer functions, so network ACLs have little or no control at that ...
user avatar
  • 62.4k
2 votes

Waiting time in CSMA/CD doubt

First off, CSMA/CD is ancient and hopefully not in serious use any more. The timing for coax (10BASE5/2) is 16 BT for the potential collision detection delay followed by 32 BT jam time for all PHYs. ...
user avatar
  • 70.5k
2 votes

Can the data usage be Oriented by Consume of Demand?

If I understand correctly, the problem is how to charge users based on how fast they consume data, rather than (or in addition to) how much data they consumed Cisco IOS has a "show interfaces" ...
user avatar
  • 2,396
2 votes

Can the data usage be Oriented by Consume of Demand?

If you want to measure traffic and charge users based on how much traffic they generate, you will need to configure Netflow (or similar) to record traffic use. If you want to limit each users' share ...
user avatar
  • 62.4k
2 votes
Accepted

Access list with SNMP v3 Cisco

The problem is that you don't have the access option on the ASA snmp-server user command like you do on IOS. snmp-server user username group-name { v3 [ encrypted ]] [ auth { md5 | sha ]} auth-...
user avatar
  • 93.5k
2 votes
Accepted

Configuring static NAT on Cisco Router

If Gig8 gets it's IP address dynamically (DHCP, PPPoE), you'll have to do this (in short: replace 1.2.3.4 with the interface name). ip nat inside source static tcp 192.168.170.108 8080 ...
user avatar
2 votes
Accepted

ASA Firewall Can PING cannot SSH to switch on different interface

Considering that your ruleset is correct... Have you checked on the switch side? There might be an access-class configured on your vty. p.s. you may want to use packet-tracer on ASA to check if ...
user avatar
  • 767

Only top scored, non community-wiki answers of a minimum length are eligible