Hot answers tagged

13 votes
Accepted

Unusual wildcard mask in Cisco ACL configuration

That is a valid wildcard mask. It will match any IP with the format 10.(160-191).1.(0-255). Whether or not this is intended, or good design, is unknown. Wildcard masks are just "do-we-care" bitwise ...
user avatar
  • 1,170
8 votes

Nexus 7010 ACL Error

When you apply the ACL to a layer2 trunk, this is called a Port ACL, use the ip port access-group syntax to apply it instead of ip access-group... explicitly... IS_NEXUS_7010(config)# interface ...
user avatar
8 votes

Difference between firewall and ACL

ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
user avatar
  • 63k
7 votes
Accepted

HP Procurve 5406zl - ACL issue

According to the Access Security Guide for your device, the first address and mask of an ACE is source and the second address and mask is the destination. (Just in case, an ACE is an Access Control ...
user avatar
7 votes
Accepted

Do VLANs with no ACL assigned block inter-VLAN traffic by default?

VLANs are entirely separate; effectively the same as two separate LANs on separate switches. If there's a route between them. such as with a router connected to both VLANs (or routing enabled in a so-...
user avatar
  • 15.9k
6 votes
Accepted

ACL Question. access-list permit ip any any

Referring to IP in an access list refers to all IP based protocols. You have denied echo replies but all other messages as ICMP redirect, time exceeded, fragmentation needed, echo would be allowed ...
user avatar
  • 7,448
6 votes
Accepted

Could adding new systems to the network suddenly block access to the internet if Access Lists are unchanged?

Based on the wildcard mask you've specified within the access-list above (which permits only ip addresses from 10.10.10.0-10.0.0.7 rest would be implicitly denied),yes you will need to change the ...
user avatar
6 votes

What do the parentheses "()" after objects mean in Cisco ASA ACLs?

Great question! You're right in thinking that it is a function of your object-group. You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-...
user avatar
  • 549
6 votes
Accepted

ACL on Nexus 3064PQ performance

That 3K and 9K platforms don't really have a notion of software switching. If it can't be programmed in the forwarding ASIC then it's not forwarded. There are a couple of minor exceptions but for ...
user avatar
  • 6,036
6 votes
Accepted

delete object network in cisco ASA with packet tracert

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
user avatar
  • 4,661
6 votes
Accepted

Cisco ACL numbering

Over the years, Cisco has supported various protocols, and has had ACLs for the various protocols, each with a number range for the numbered ACLs (today, we mostly use named ACLs)*: +------------------...
user avatar
  • 94.1k
5 votes
Accepted

Access-Lists and VLAN and understanding traffic flow

This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of "gateway" and that traffic ...
user avatar
  • 26.8k
5 votes
Accepted

Why "Deny all" statement in ACL is not working?

Normally you would be right, there is an implied "deny" at the end of every access list. You have found the exception however, because you use an empty access list: interface Serial2/0 ip address ...
user avatar
  • 1,909
5 votes
Accepted

(Cisco) ACL direction (in/out)?

The terms IN and OUT are in reference to the router interface. So IN means traffic coming into the router from that interface. OUT means traffic leaving the router interface.
user avatar
  • 63k
5 votes
Accepted

How does a Cisco ACL handle fragments

You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem. ACLs and Fragmented Packets ACLs have a fragments keyword ...
user avatar
  • 94.1k
5 votes
Accepted

Will Cisco IOS routers pass all traffic by default without ACLs?

If there no ACL's added on interface, then all traffic will be passed. Same will be if you're create empty ACL and assign it to interface. Each ACL have explicit deny in the end of list, but it works ...
user avatar
5 votes
Accepted

ACL based on VLAN

First you define the rule, e.g. deny 192.168.1.1 DNS access anywhere, permit everything else: ip access-list extended "rulename" 10 deny udp 192.168.1.1/32 any eq 53 log 9999 permit ip any any exit ...
user avatar
  • 71.6k
5 votes
Accepted

How to add multiple ip address in destination ip in acl rule

deny ip 10.10.10.10/32 255.255.255.255/32 should do it for e.g. 10.10.10.10 as source. If you want to filter multiple source IPs you need multiple ACL entries unless you can fit a mask to all sources....
user avatar
  • 71.6k
5 votes
Accepted

Access control on Cisco router with switchports?

This answer focuses on the following part: or is there a better way to segregate traffic as I require? Overall, it might turn out to be easier to run two internal VLANs with each their SVI (...
user avatar
5 votes
Accepted

Cisco Nexus 9300 TCAM carving

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-...
user avatar
  • 2,083
5 votes
Accepted

VLAN Filtering not working

Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it. The first thing you need to do is ...
user avatar
  • 2,083
5 votes
Accepted

Correct ACL rules to isolate WiFi traffic from other VLANs?

Since you want to permit WAN traffic, matching only any, you need to have a permit any any at the end. Basically, you want to deny traffic in and out of the Wi-Fi VLAN. For each of the other VLANs you ...
user avatar
  • 71.6k
4 votes
Accepted

Network ACLs vs File System ACLs

Without saying it, you have the right notion, it all comes down to speed and flexibility. This is directly related to the amount of runtime operations and parameters you must check against. I’m not ...
user avatar
  • 5,449
4 votes

How does ingress filtering protect against legitimate spoof packets?

If a hacker spoofs packets which match your SRC/DST fields at any line in an ACL, then the firewall is going to allow the traffic. The only exception to this is if you have a stateful firewall, and ...
user avatar
  • 3,300
4 votes

ACLs - what does the number of matches mean?

The number is the number of packets that matched the particular ACE (line). So for example, there were 37,414 packets that matched line 10.
user avatar
  • 63k
4 votes

Cisco ACL not working as expected

There is an implicit "deny" at the end of every access-list. So your current access-list actually says: access-list 111 deny udp (insert client ip) any eq 137 access-list 111 permit udp any any ...
user avatar
  • 1,909
4 votes

Access-Lists and VLAN and understanding traffic flow

Think of all the ports in the vlan as being one port, traffic between them never hit the vlan-L3 interface. Only traffic flowing between vlan's hit the vlan-32 ACL. Thus traffic from vlan-X to ...
user avatar
  • 1,397
4 votes

Cisco - ACL Clarification

I don't mean for this to be considered an answer, I just wanted to show the output of testing @OzNetNerd's answer. I configured three routers: R1 ----- R2 ----- R3 Gave them each an IP and a ...
user avatar
  • 14k
4 votes

ASA NAT & ACL question

Since ASA 8.3 code, the interface ACLs expect the real-ip in each statement. In your example, your real-ip is 10.15.x.x. As such, your ACL entry will have to look like this: access-list ...
user avatar
  • 14k
4 votes
Accepted

Is somebody trying to hack me?

Does this mean that someone is trying to get login over SSH/Telnet to my ASA? Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you ...
user avatar
  • 63k

Only top scored, non community-wiki answers of a minimum length are eligible