10
votes
Difference between firewall and ACL
ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
- 67.1k
7
votes
Accepted
Do VLANs with no ACL assigned block inter-VLAN traffic by default?
VLANs are entirely separate; effectively the same as two separate LANs on separate switches.
If there's a route between them. such as with a router connected to both VLANs (or routing enabled in a so-...
- 16.2k
6
votes
Accepted
ACL on Nexus 3064PQ performance
That 3K and 9K platforms don't really have a notion of software switching. If it can't be programmed in the forwarding ASIC then it's not forwarded. There are a couple of minor exceptions but for ...
- 6,104
6
votes
Accepted
delete object network in cisco ASA with packet tracert
It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
- 4,690
6
votes
Accepted
Cisco ACL numbering
Over the years, Cisco has supported various protocols, and has had ACLs for the various protocols, each with a number range for the numbered ACLs (today, we mostly use named ACLs)*:
+------------------...
- 98.8k
5
votes
Accepted
Why "Deny all" statement in ACL is not working?
Normally you would be right, there is an implied "deny" at the end of every access list. You have found the exception however, because you use an empty access list:
interface Serial2/0
ip address ...
- 1,949
5
votes
Accepted
(Cisco) ACL direction (in/out)?
The terms IN and OUT are in reference to the router interface. So IN means traffic coming into the router from that interface. OUT means traffic leaving the router interface.
- 67.1k
5
votes
Accepted
How does a Cisco ACL handle fragments
You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem.
ACLs and Fragmented Packets
ACLs have a fragments keyword ...
- 98.8k
5
votes
Accepted
Will Cisco IOS routers pass all traffic by default without ACLs?
If there no ACL's added on interface, then all traffic will be passed. Same will be if you're create empty ACL and assign it to interface. Each ACL have explicit deny in the end of list, but it works ...
- 2,774
5
votes
Accepted
ACL based on VLAN
First you define the rule, e.g. deny 192.168.1.1 DNS access anywhere, permit everything else:
ip access-list extended "rulename"
10 deny udp 192.168.1.1/32 any eq 53 log
9999 permit ip any any
exit
...
- 82.7k
5
votes
Accepted
How to add multiple ip address in destination ip in acl rule
deny ip 10.10.10.10/32 255.255.255.255/32 should do it for e.g. 10.10.10.10 as source.
If you want to filter multiple source IPs you need multiple ACL entries unless you can fit a mask to all sources....
- 82.7k
5
votes
Accepted
Access control on Cisco router with switchports?
This answer focuses on the following part:
or is there a better way to segregate traffic as I require?
Overall, it might turn out to be easier to run two internal VLANs with each their SVI (...
- 8,826
5
votes
Accepted
Cisco Nexus 9300 TCAM carving
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-...
- 2,183
5
votes
Accepted
VLAN Filtering not working
Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it.
The first thing you need to do is ...
- 2,183
5
votes
Accepted
Correct ACL rules to isolate WiFi traffic from other VLANs?
Since you want to permit WAN traffic, matching only any, you need to have a permit any any at the end.
Basically, you want to deny traffic in and out of the Wi-Fi VLAN. For each of the other VLANs you ...
- 82.7k
4
votes
Cisco ACL not working as expected
There is an implicit "deny" at the end of every access-list. So your current access-list actually says:
access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
...
- 1,949
4
votes
Cisco - ACL Clarification
I don't mean for this to be considered an answer, I just wanted to show the output of testing @OzNetNerd's answer.
I configured three routers:
R1 ----- R2 ----- R3
Gave them each an IP and a ...
- 15k
4
votes
ASA NAT & ACL question
Since ASA 8.3 code, the interface ACLs expect the real-ip in each statement.
In your example, your real-ip is 10.15.x.x.
As such, your ACL entry will have to look like this:
access-list ...
- 15k
4
votes
Accepted
Is somebody trying to hack me?
Does this mean that someone is trying to get login over SSH/Telnet to
my ASA?
Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you ...
- 67.1k
4
votes
Accepted
Cisco IP Fragments ACL strange behavior
Apparently, this will treat an initial fragment the same as a non-fragment. The initial fragment will get through, but subsequent fragments in the same packet will be dropped.
See Access Control ...
- 98.8k
4
votes
Accepted
Understanding Cisco standard access lists (Packet Tracer example)
Ping is an application that is bidirectional. It sends an ICMP request, and expects an ICMP reply. You have broken the traffic from one direction, so you cannot ping either direction (one way the ...
- 98.8k
4
votes
Accepted
Cisco ASA 5510 - ACL Config Question
One way to modify your ACL is to simply create a new one, then apply it to the interface. The advantage of this method is you can quickly revert back if you've made a mistake, and you can see what ...
- 67.1k
4
votes
Do VLANs with no ACL assigned block inter-VLAN traffic by default?
First of all, your configuration doesn't have IP addresses assigned on L3 interfaces on your switch. So if that will remain, hosts in VLAN 11 and VLAN 12 will not be able to talk to each other.
If ...
- 2,774
4
votes
Accepted
Issue with ACL and router on a stick network
With this ACL:
ip access-list extended IT_SEGMENT
permit ip 10.1.10.0 0.0.0.31 10.1.30.0 0.0.0.31
!
You are limiting traffic coming in from that interface to only the 10.1.30.0/27 network because ...
- 98.8k
4
votes
Accepted
Is "Host unreachable" the same as "Communication administratively prohibited" in Access List ping response?
Practically it's the same. The router isn't silently dropping the packets but returning an ICMP error message 3/13, informing the sender that the packet has been filtered.
Users often don't care why ...
- 82.7k
4
votes
Providing wildcard mask in extended ACL
ACLs use wildcards. You need to use e.g.
ip access-list 107 deny ip 192.168.5.2/32 192.168.7.2/32
The /32 is equivalent to the 0.0.0.0 wildcard = no wildcard bits. Alternatively, you can use the ...
- 82.7k
4
votes
Accepted
Why does the Implicit Rule prevent traffic from passing?
I have seen this countless times when one configures explicit ACL's on interfaces.
By default, if there exist exactly zero access control lists, the ASA will freely PERMIT all traffic from higher ...
- 68
4
votes
Accepted
ACL on routers to block TCP/UDP ports
Cisco routers (and others) can filter packets based on tcp and udp ports.
When we say routers are only layer 3 devices, we are talking about idealized routing functions. In practice, manufacturers ...
- 67.1k
4
votes
ACL on routers to block TCP/UDP ports
In general all routers have header inspection capabilities, this is just parsing the TCP or UDP headers so after this parsing or decoding phase they can search on the ACLs in order to accept the flows ...
- 294
Only top scored, non community-wiki answers of a minimum length are eligible