Skip to main content
Share Your Experience: Take the 2024 Developer Survey
10 votes

Difference between firewall and ACL

ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
Ron Trunk's user avatar
  • 67.7k
7 votes
Accepted

Do VLANs with no ACL assigned block inter-VLAN traffic by default?

VLANs are entirely separate; effectively the same as two separate LANs on separate switches. If there's a route between them. such as with a router connected to both VLANs (or routing enabled in a so-...
jonathanjo's user avatar
  • 16.3k
6 votes
Accepted

ACL on Nexus 3064PQ performance

That 3K and 9K platforms don't really have a notion of software switching. If it can't be programmed in the forwarding ASIC then it's not forwarded. There are a couple of minor exceptions but for ...
rnxrx's user avatar
  • 6,114
6 votes
Accepted

delete object network in cisco ASA with packet tracert

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
Jesse P.'s user avatar
  • 4,690
6 votes
Accepted

Cisco ACL numbering

Over the years, Cisco has supported various protocols, and has had ACLs for the various protocols, each with a number range for the numbered ACLs (today, we mostly use named ACLs)*: +------------------...
Ron Maupin's user avatar
  • 99.8k
5 votes
Accepted

How does a Cisco ACL handle fragments

You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem. ACLs and Fragmented Packets ACLs have a fragments keyword ...
Ron Maupin's user avatar
  • 99.8k
5 votes
Accepted

(Cisco) ACL direction (in/out)?

The terms IN and OUT are in reference to the router interface. So IN means traffic coming into the router from that interface. OUT means traffic leaving the router interface.
Ron Trunk's user avatar
  • 67.7k
5 votes
Accepted

Will Cisco IOS routers pass all traffic by default without ACLs?

If there no ACL's added on interface, then all traffic will be passed. Same will be if you're create empty ACL and assign it to interface. Each ACL have explicit deny in the end of list, but it works ...
Andrey Prokhorov's user avatar
5 votes
Accepted

ACL based on VLAN

First you define the rule, e.g. deny 192.168.1.1 DNS access anywhere, permit everything else: ip access-list extended "rulename" 10 deny udp 192.168.1.1/32 any eq 53 log 9999 permit ip any any exit ...
Zac67's user avatar
  • 84.9k
5 votes
Accepted

How to add multiple ip address in destination ip in acl rule

deny ip 10.10.10.10/32 255.255.255.255/32 should do it for e.g. 10.10.10.10 as source. If you want to filter multiple source IPs you need multiple ACL entries unless you can fit a mask to all sources....
Zac67's user avatar
  • 84.9k
5 votes
Accepted

Access control on Cisco router with switchports?

This answer focuses on the following part: or is there a better way to segregate traffic as I require? Overall, it might turn out to be easier to run two internal VLANs with each their SVI (...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

Cisco Nexus 9300 TCAM carving

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-...
Darrell Root's user avatar
  • 2,203
5 votes
Accepted

VLAN Filtering not working

Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it. The first thing you need to do is ...
Darrell Root's user avatar
  • 2,203
5 votes
Accepted

Correct ACL rules to isolate WiFi traffic from other VLANs?

Since you want to permit WAN traffic, matching only any, you need to have a permit any any at the end. Basically, you want to deny traffic in and out of the Wi-Fi VLAN. For each of the other VLANs you ...
Zac67's user avatar
  • 84.9k
4 votes
Accepted

Is somebody trying to hack me?

Does this mean that someone is trying to get login over SSH/Telnet to my ASA? Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you ...
Ron Trunk's user avatar
  • 67.7k
4 votes
Accepted

Cisco IP Fragments ACL strange behavior

Apparently, this will treat an initial fragment the same as a non-fragment. The initial fragment will get through, but subsequent fragments in the same packet will be dropped. See Access Control ...
Ron Maupin's user avatar
  • 99.8k
4 votes
Accepted

Understanding Cisco standard access lists (Packet Tracer example)

Ping is an application that is bidirectional. It sends an ICMP request, and expects an ICMP reply. You have broken the traffic from one direction, so you cannot ping either direction (one way the ...
Ron Maupin's user avatar
  • 99.8k
4 votes
Accepted

Cisco ASA 5510 - ACL Config Question

One way to modify your ACL is to simply create a new one, then apply it to the interface. The advantage of this method is you can quickly revert back if you've made a mistake, and you can see what ...
Ron Trunk's user avatar
  • 67.7k
4 votes

Do VLANs with no ACL assigned block inter-VLAN traffic by default?

First of all, your configuration doesn't have IP addresses assigned on L3 interfaces on your switch. So if that will remain, hosts in VLAN 11 and VLAN 12 will not be able to talk to each other. If ...
Andrey Prokhorov's user avatar
4 votes
Accepted

Issue with ACL and router on a stick network

With this ACL: ip access-list extended IT_SEGMENT permit ip 10.1.10.0 0.0.0.31 10.1.30.0 0.0.0.31 ! You are limiting traffic coming in from that interface to only the 10.1.30.0/27 network because ...
Ron Maupin's user avatar
  • 99.8k
4 votes
Accepted

Is "Host unreachable" the same as "Communication administratively prohibited" in Access List ping response?

Practically it's the same. The router isn't silently dropping the packets but returning an ICMP error message 3/13, informing the sender that the packet has been filtered. Users often don't care why ...
Zac67's user avatar
  • 84.9k
4 votes

Providing wildcard mask in extended ACL

ACLs use wildcards. You need to use e.g. ip access-list 107 deny ip 192.168.5.2/32 192.168.7.2/32 The /32 is equivalent to the 0.0.0.0 wildcard = no wildcard bits. Alternatively, you can use the ...
Zac67's user avatar
  • 84.9k
4 votes
Accepted

Why does the Implicit Rule prevent traffic from passing?

I have seen this countless times when one configures explicit ACL's on interfaces. By default, if there exist exactly zero access control lists, the ASA will freely PERMIT all traffic from higher ...
sietecFAST's user avatar
4 votes
Accepted

ACL on routers to block TCP/UDP ports

Cisco routers (and others) can filter packets based on tcp and udp ports. When we say routers are only layer 3 devices, we are talking about idealized routing functions. In practice, manufacturers ...
Ron Trunk's user avatar
  • 67.7k
4 votes

ACL on routers to block TCP/UDP ports

In general all routers have header inspection capabilities, this is just parsing the TCP or UDP headers so after this parsing or decoding phase they can search on the ACLs in order to accept the flows ...
camp0's user avatar
  • 294
4 votes

Access list command for specific IP range in Cisco Router 1921

ACL use either hosts or networks, not ranges. Networks are bounded by power of 2 values. Your range doesn't correspond to a single network. The best you can do is split your range into 4 valid ...
JFL's user avatar
  • 19.7k
4 votes
Accepted

Cisco ASA Clientless SSL VPN Restrict Network Access

What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”. So, if you want to allow your VPN subnet to only talk with something ...
Jesse P.'s user avatar
  • 4,690
4 votes

Difference between firewall and ACL

Stateful inspection is the easy answer to what is the difference between a firewall and access control list. Access lists (ACLs) define interesting traffic. An ACL specifies network addresses and ...
Ronnie Royston's user avatar
4 votes
Accepted

Cisco router access list not working as expected

Change the direction of the ACL to out. ip access-group 1 out The direction is from the perspective of the router interface. Out means out of the interface, towards the devices.
Ron Trunk's user avatar
  • 67.7k

Only top scored, non community-wiki answers of a minimum length are eligible