7
votes
Accepted
Is the root user on juniper switches useful?
Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly.
The biggest practical example I can ...
- 6,440
5
votes
Accepted
Multiple access lists on same vlan
You can't have more than one access list per direction on an interface. So, to accomplish this, you will have to create a unique access-list for each interface that allows only the traffic you want.
- 62.4k
5
votes
Accepted
Is this extended acl valid?
The any eq 80 filters for the source port - applying that to a HTTP client makes it near impossible to connect to the server. HTTP clients use ephemeral source ports (49152-65535).
Since you don't ...
- 70.5k
4
votes
Is the root user on juniper switches useful?
The root user for any *nix platform is capable of performing any functions on the system they want - and I mean anything. I'd suggest you look into a wiki article on this as it is a little beyond the ...
- 5,449
4
votes
Cisco ACL not working as expected
There is an implicit "deny" at the end of every access-list. So your current access-list actually says:
access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
...
- 1,899
4
votes
Accepted
Whether we usual use dot-decimal notation to represent network or IP by opposite mask?
As far as I know, the only thing which uses the "opposite mask" are the "wildcard bits" of access control lists in Cisco equipment. These can represent hosts or networks (and portions or aggregations ...
- 15.9k
4
votes
How do I block IPs on my network?
You need to set up 802.1X, that way you can guarantee that users are strongly authenticated before accessing the company Wifi. Use RADIUS or if it's a small network you can get by with the built-in ...
- 2,229
4
votes
Why my simple standard ACL outbound doesn't block the gateway's traffic/ping of the VLAN's SVI?
You can still ping the router IP because the ACL is only applied to traffic passing through the interface and not to the interface itself.
Well if you want to make it as described, you'll have to do ...
- 1,700
3
votes
Accepted
Access-list won't show all hit matches
If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, ...
- 4,010
3
votes
Accepted
Extended access list conflict condition will it cause override?
Access lists work on a first-match basis. The traffic will be compared to the list, starting with the first statement in the list. As soon as a match is found, then the router exits the list.
- 93.5k
3
votes
Accepted
ip ssh source-interface vlan - allow ssh from specific vlan not working
You are using the wrong command.
ip ssh source-interface command defines the source IP when starting an SSH session from the router. It has no effect on other traffic.
To control who can SSH into ...
- 62.4k
3
votes
Access Control List from a network to a specific device on another network.
You are confusing routing with traffic flow. The routing protocol is used to learn networks from other routers. It does not directly affect the flow of traffic. If you want to block access to the ...
- 62.4k
3
votes
For ethernet with bandwidth B, how much time a node has to wait before sensing the channel after the first collision detected?
Nodes back off a random amount of time after a collision before trying to transmit. This prevents all the nodes from trying to transmit at the same time after a collision, causing another collision.
- 93.5k
3
votes
Standard access list
Standard access lists filter on source addresses. So ACL 20 only allows packets whose source IP is 192.168.20.x. But Vlan 10 is a different subnet, so any packet from VLAN 10 is dropped.
When you ...
- 62.4k
3
votes
Accepted
Router Extended Access Control List
You can place an extended ACL where you want (as long as it is in the path of the packet you want to filter of course). However, depending on the filtering parameters, it is usually better to put it ...
- 861
3
votes
Accepted
How is P actually chosen in P-persistent CSMA?
So, this question actually asks two question:
how to find the optimal value of p.
given a value of p, how to set this value of p on any participating system.
For the first question: I would say that ...
- 1,310
2
votes
Networking, dedicating bandwidth to specific networks
There are lots of ways to use Cisco routers with advanced routing features that can do what you are looking to do. They all fall under "Quality of Service," or QoS for short. Cisco routers can ...
- 121
2
votes
Accepted
Cisco VPN Clients Routing Over IPSec VPN - ACL?
Obviously you aren't using a Cisco VPN client, as it monitors the route table and will remove your tampering immediately. Even if the routes stick, the ASA will ignore traffic that doesn't belong in ...
- 29.6k
2
votes
Limiting community member communication in PVLAN's
Private VLANS are a layer 2 technology. To filter specific ports, you need something that operates at layer 4. There are virtualized firewalls that would be applied per VM that could do this for you....
- 62.4k
2
votes
Access Control List from a network to a specific device on another network.
You want to deny IP packets from that network. Update the first line of your ACL to read access-list 106 deny ip 192.168.3.0 0.0.0.31 host Server and you should be good.
The fact that OSPF is your ...
- 1,470
2
votes
Multiple access and full/half duplex point-to-point links
Shared physical media: only one device on the shared media can access it at any given time, the rest has to wait.
Halfduplex point to point links, uses the same physical media in both directions. It ...
- 1,397
2
votes
Accepted
Open up port for one IP
If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming ...
- 93.5k
2
votes
Accepted
Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL
Thank you both for your input. I removed the global nat pool for xx.xx.xx.219, moved the web server being hosted at xx.xx.xx.218 to 219, and changed the webvpn port to 443 for standard https on 218. ...
- 51
2
votes
Access Control Permissions
Access control lists operate at layers 3 and 4 of the OSI or TCP/IP model. File operations like reading and writing are application layer functions, so network ACLs have little or no control at that ...
- 62.4k
2
votes
Waiting time in CSMA/CD doubt
First off, CSMA/CD is ancient and hopefully not in serious use any more.
The timing for coax (10BASE5/2) is 16 BT for the potential collision detection delay followed by 32 BT jam time for all PHYs. ...
- 70.5k
2
votes
Can the data usage be Oriented by Consume of Demand?
If I understand correctly, the problem is how to charge users based on how fast they consume data, rather than (or in addition to) how much data they consumed
Cisco IOS has a "show interfaces" ...
- 2,396
2
votes
Can the data usage be Oriented by Consume of Demand?
If you want to measure traffic and charge users based on how much traffic they generate, you will need to configure Netflow (or similar) to record traffic use.
If you want to limit each users' share ...
- 62.4k
2
votes
Accepted
Access list with SNMP v3 Cisco
The problem is that you don't have the access option on the ASA snmp-server user command like you do on IOS.
snmp-server user username group-name { v3 [ encrypted ]] [ auth { md5 | sha ]} auth-...
- 93.5k
2
votes
Accepted
Configuring static NAT on Cisco Router
If Gig8 gets it's IP address dynamically (DHCP, PPPoE), you'll have to do this (in short: replace 1.2.3.4 with the interface name).
ip nat inside source static tcp 192.168.170.108 8080 ...
- 7,736
2
votes
Accepted
ASA Firewall Can PING cannot SSH to switch on different interface
Considering that your ruleset is correct... Have you checked on the switch side? There might be an access-class configured on your vty.
p.s. you may want to use packet-tracer on ASA to check if ...
- 767
Only top scored, non community-wiki answers of a minimum length are eligible