Hot answers tagged

16

The reason your router hangs is because you're editing the ACL through the same interface that it's applied to. Usually what happens is you wind up blocking yourself accidentally. Note that I make a suggestion for reorganizing your ACLs at the bottom of this answer, although most people will be interested in this first section (the easiest way to change ...


13

That is a valid wildcard mask. It will match any IP with the format 10.(160-191).1.(0-255). Whether or not this is intended, or good design, is unknown. Wildcard masks are just "do-we-care" bitwise masks used when looking at an IP -- a value of 0 means "do-care", and 1 means "don't-care". In this case, 0.31.0.255 translates to: 00000000 00011111 ...


9

R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip access-group 1 in When i try to ping 10.1.1.1 it returns U.U.U -----> Which means destination host unreachable. The only thing you can do is add no ip unreachables to Serial0/0. This would make pings simply timeout instead of receiving an ICMP ...


8

When you apply the ACL to a layer2 trunk, this is called a Port ACL, use the ip port access-group syntax to apply it instead of ip access-group... explicitly... IS_NEXUS_7010(config)# interface Ethernet2/2 IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24 IS_NEXUS_7010(config-if)# switchport IS_NEXUS_7010(config-if)# switchport mode ...


7

According to the Access Security Guide for your device, the first address and mask of an ACE is source and the second address and mask is the destination. (Just in case, an ACE is an Access Control Entry; that is any line an access-list is made of) ACE 20 of your ACL states source 192.168.50.0/24 and destination 192.168.101.0/24, then you apply the ACL at ...


7

VLANs are entirely separate; effectively the same as two separate LANs on separate switches. If there's a route between them. such as with a router connected to both VLANs (or routing enabled in a so-called "Layer 3 Switch"), then packets can flow, and you might want to put in ACLs to prevent it. If your config is in a router and you add IP addresses then ...


6

Based on the wildcard mask you've specified within the access-list above (which permits only ip addresses from 10.10.10.0-10.0.0.7 rest would be implicitly denied),yes you will need to change the wildcard mask from 7 to 15 which would allow the newly added systems to communicate to the internet. Else they'd be denied by the implicit deny rule of ACL and no ...


6

Great question! You're right in thinking that it is a function of your object-group. You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-control . ACL optimisation collapses all the possible ACE combinations for source/destination addresses and ports back into your original objects. The numbers in ...


6

The reason for placing Extended ACL's as close to the source as possible is to prevent unnecessary traffic from traversing the network. The ACL will catch the packet before it routes it and therefore less routers have to process the packet and route it through the network However the reason this is suggested only with extended ACL's and not standard ACL's ...


6

The peak traffic on downstream is 3Gbps. I follow the guidelines and I've already define the ACL, just left implement them. My doubt now is how will be the throughput performance, if it's expected some degradation or the cpu will rise. Will the device can handle such traffic amount with filtering ? The 4500X uses a similar forwarding engine / TCAM to ...


6

Certainly! I believe inverse masks were created to be dis-contiguous rather than a normal subnet mask that must be contiguous. An ACL such as the following should do the trick on an IOS device. Ip access-list [standard/extended] SUBNET_240 permit ip 10.10.0.0 0.0.255.15 I am not familar with the FWSM but you should be able to create a similar ACL on ...


6

If you are using a Cisco PIX 6.2(2) and later or ASA 7.0 and later as your firewall you can do the following: Create an object-group service, but don't specify tcp-udp after you name it. Once you hit enter you will be able to use the service-object command to define what udp, tcp, or tcp-udp ports you want, as well as if it is a source or destination ...


6

Unfortunately, Cisco did away with wildcard masks in IPv6. That is mostly a good thing, EXCEPT in this particular case. For your idea to work however, you have to rely on Facebook being both "clever" and consistent, which is probably more than one can hope for. But if you want to process Facebook's traffic differently than other traffic, you can simply ...


6

Referring to IP in an access list refers to all IP based protocols. You have denied echo replies but all other messages as ICMP redirect, time exceeded, fragmentation needed, echo would be allowed through. Other IP based protocols such as OSPF would also be allowed to pass through with your ACL.


6

That 3K and 9K platforms don't really have a notion of software switching. If it can't be programmed in the forwarding ASIC then it's not forwarded. There are a couple of minor exceptions but for standard unicast/multicast forwarding it's going to either go in hardware or not at all. This, incidentally, is why the number of ACL's supported on these ...


6

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (by just saying "no" on its only line). What you need to do is: clear config access-list out2in This will disassociate the access-list with the interface and ...


6

Over the years, Cisco has supported various protocols, and has had ACLs for the various protocols, each with a number range for the numbered ACLs (today, we mostly use named ACLs)*: +-----------------------------------------------------+-----------------------+ | Protocol | Range | +------------------...


5

The direction is always in reference to the router itself. In your example, you have applied the ACL inbound on E0/0. So the ACL applies to traffic from the source entering the router on E0/0. Which direction you apply the ACL depends on what you are trying to do. But generally, it is better to filter as close to the source as possible. There's no ...


5

I was doing some playing with FPM and I think it may do what you're looking for: load protocol system:fpm/phdf/ether.phdf load protocol flash:/fpm/phdf/ipv6.phdf ! class-map type stack match-all cm-ipv6  match field ETHER type eq 0x86DD next IPV6 class-map type access-control match-all cm-ipv6-facebook  match start IPV6 dest-addr offset 9 size 4 eq ...


5

Your problem is, indeed, with routing. Things in VLAN 1 are using 5.1 as the gateway, right? 5.1 doesn't know about any other internal networks. (i.e. VLAN 10) Likewise, the hosts in VLAN 1 don't know about VLAN 10. When clientA tries to ping serverA, the packets go to the ASA and die as it doesn't know where to send them. (it's default route would send ...


5

This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of "gateway" and that traffic leaving the VLAN should be outbound and vice versa. However, it actually works in the opposite way because the SVI is a virtual router interface. It can help to ...


5

Normally you would be right, there is an implied "deny" at the end of every access list. You have found the exception however, because you use an empty access list: interface Serial2/0 ip address 192.168.1.2 255.255.255.0 ip access-group ACL_FOR_R2 in serial restart-delay 0 ! <snip> ! ip access-list extended ACL_FOR_R2 ! According to the ...


5

The terms IN and OUT are in reference to the router interface. So IN means traffic coming into the router from that interface. OUT means traffic leaving the router interface.


5

You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem. ACLs and Fragmented Packets ACLs have a fragments keyword that enables specialized fragmented packet-handling behavior. In general, noninitial fragments that match the Layer 3 statements (protocol, source address, ...


5

If there no ACL's added on interface, then all traffic will be passed. Same will be if you're create empty ACL and assign it to interface. Each ACL have explicit deny in the end of list, but it works only if ACL have at least one rule.


5

First you define the rule, e.g. deny 192.168.1.1 DNS access anywhere, permit everything else: ip access-list extended "rulename" 10 deny udp 192.168.1.1/32 any eq 53 log 9999 permit ip any any exit Then you apply the rule to the VLAN 99: vlan 99 ip access-group "rulename" Edit: There's an implicit last entry deny ip any any that will drop all remaining ...


5

deny ip 10.10.10.10/32 255.255.255.255/32 should do it for e.g. 10.10.10.10 as source. If you want to filter multiple source IPs you need multiple ACL entries unless you can fit a mask to all sources. For instance, deny ip 10.10.10.8/30 255.255.255.255/32 filters all broadcasts from hosts 10.10.10.8 through 10.10.10.11. Note that wildcard masks needn't be ...


5

This answer focuses on the following part: or is there a better way to segregate traffic as I require? Overall, it might turn out to be easier to run two internal VLANs with each their SVI (interface vlan XXX) with each their own subnet, and accepting the (possibly still small) disadvantage of having to renumber some hosts. If you do, instead of trying ...


5

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_chapter_01010.html#concept_945210FB9986499285C6A00065105AC9 (Quote from documentation) Atomic ACL Updates By default, when a ...


5

Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it. The first thing you need to do is figure out exactly what you want your access-map to do. Here's what I think you want: Permit traffic between your (RFC1918) subnet and internet-routable space (...


Only top voted, non community-wiki answers of a minimum length are eligible