Hot answers tagged

25

Here's the history of how they came into being (and why they are the way they are): In the very early days of the Internet, people started asking for packet filters (aka access lists). Cisco implemented simple access lists first (filtering on destination host addresses, augmented by wildcard masks), but of course they weren't good enough to block (for ...


18

Every time you see .+_, that regular expression represents a single BGP autonomous system. This as-path list denies BGP as paths equal to or longer than 12 paths long. The regular expression works because . represents any character, + is a wild card which optionally repeats the previous character an unlimited number of times, and _ represents the space ...


18

I don't believe that there is anything simpler than show interfaces | <some regex> unfortunately. Edit: From the comments below, @Santino pointed out a more concise RegEx: show ip interface | include line protocol|access list My testing so far indicates that this gives the same results as my longer RegEx below. I usually use the following to find ...


16

The reason your router hangs is because you're editing the ACL through the same interface that it's applied to. Usually what happens is you wind up blocking yourself accidentally. Note that I make a suggestion for reorganizing your ACLs at the bottom of this answer, although most people will be interested in this first section (the easiest way to change ...


14

Fully agreed with Stefan. VRF is the way to go here. Quick example how to incorporate it to suggested config: ip vrf VLAN1 rd 42:1 ip vrf VLAN2 rd 42:2 ! int vlan1 ip vrf forwarding VLAN1 ip address 1.1.1.1 255.255.255.0 int vlan2 ip vrf forwading VLAN2 ip address 2.2.2.2 255.255.255.0 ! Now vlan1 and vlan2 routing is separated. To inspect ...


13

There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: nslookup facebook.com. This gives you the associated IP address to that DNS name; in this case, 173.252.110.27 was the answer from my DNS server. Then run a "whois" lookup ...


13

That is a valid wildcard mask. It will match any IP with the format 10.(160-191).1.(0-255). Whether or not this is intended, or good design, is unknown. Wildcard masks are just "do-we-care" bitwise masks used when looking at an IP -- a value of 0 means "do-care", and 1 means "don't-care". In this case, 0.31.0.255 translates to: 00000000 00011111 ...


11

permit tcp any any eq <protocol-port> Allows any traffic with a destination TCP port == protocol-port permit tcp any eq <protocol-port> any Allows any traffic with a source TCP port == protocol-port Example ACLs tend to use fixed ports for the server-side of a client-server connection. Typically, the client connects to a well-known port on ...


10

Not a whole lot. They both provide means to filter on network addresses, but there are a couple key differences: Extended ACL's can filter based on "higher layer" information, ie TCP/UDP port. Prefix lists cannot. Extended/Standard ACL's can use wildcard masks which allow for the specification of arbitrary addresses or ranges of addresses. Prefix lists can'...


10

Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses? Using Facebook as an example... We police their bandwidth to a small fraction of our total directly on our ASA (because another group in the company owns the web-proxy). I normally lookup the ASN of the company (Facebook is 32934), then I go to http://as.robtex.com/...


9

R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip access-group 1 in When i try to ping 10.1.1.1 it returns U.U.U -----> Which means destination host unreachable. The only thing you can do is add no ip unreachables to Serial0/0. This would make pings simply timeout instead of receiving an ICMP ...


9

While ACLs are a simple and safe way, it doesn't scale well indeed. If your router provides VRF or at least the the VRF Lite feature you could group VLANs into VRFs. A VRF can be seen like a virtual router, VRF instances cannot talk to each other unless you explicitely define routing between them. In a complex network, I group VLANs into several security ...


8

Yes, you can use a reflexive ACL but it couldn't possibly be as secure as a stateful inspection firewall. Since you are studying for the CCNA, you should build the lab network like real customers do. IOS has a real stateful inspection fw; I would use that.


8

When you apply the ACL to a layer2 trunk, this is called a Port ACL, use the ip port access-group syntax to apply it instead of ip access-group... explicitly... IS_NEXUS_7010(config)# interface Ethernet2/2 IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24 IS_NEXUS_7010(config-if)# switchport IS_NEXUS_7010(config-if)# switchport mode ...


7

According to the Access Security Guide for your device, the first address and mask of an ACE is source and the second address and mask is the destination. (Just in case, an ACE is an Access Control Entry; that is any line an access-list is made of) ACE 20 of your ACL states source 192.168.50.0/24 and destination 192.168.101.0/24, then you apply the ACL at ...


7

VLANs are entirely separate; effectively the same as two separate LANs on separate switches. If there's a route between them. such as with a router connected to both VLANs (or routing enabled in a so-called "Layer 3 Switch"), then packets can flow, and you might want to put in ACLs to prevent it. If your config is in a router and you add IP addresses then ...


6

Certainly! I believe inverse masks were created to be dis-contiguous rather than a normal subnet mask that must be contiguous. An ACL such as the following should do the trick on an IOS device. Ip access-list [standard/extended] SUBNET_240 permit ip 10.10.0.0 0.0.255.15 I am not familar with the FWSM but you should be able to create a similar ACL on ...


6

If you are using a Cisco PIX 6.2(2) and later or ASA 7.0 and later as your firewall you can do the following: Create an object-group service, but don't specify tcp-udp after you name it. Once you hit enter you will be able to use the service-object command to define what udp, tcp, or tcp-udp ports you want, as well as if it is a source or destination ...


6

Prefix-list is used for route-filtering and route redistribution because it matches on prefixes either sent,received or present in the routing table or BGP table. They match on bits in the prefix but also on the prefix-length. ACLs can be used for a lot more features like: traffic filtering, matching traffic for QoS,matching traffic for NAT, VPN,Policy ...


6

Unfortunately, Cisco did away with wildcard masks in IPv6. That is mostly a good thing, EXCEPT in this particular case. For your idea to work however, you have to rely on Facebook being both "clever" and consistent, which is probably more than one can hope for. But if you want to process Facebook's traffic differently than other traffic, you can simply ...


6

The peak traffic on downstream is 3Gbps. I follow the guidelines and I've already define the ACL, just left implement them. My doubt now is how will be the throughput performance, if it's expected some degradation or the cpu will rise. Will the device can handle such traffic amount with filtering ? The 4500X uses a similar forwarding engine / TCAM to ...


6

The reason for placing Extended ACL's as close to the source as possible is to prevent unnecessary traffic from traversing the network. The ACL will catch the packet before it routes it and therefore less routers have to process the packet and route it through the network However the reason this is suggested only with extended ACL's and not standard ACL's ...


6

Great question! You're right in thinking that it is a function of your object-group. You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-control . ACL optimisation collapses all the possible ACE combinations for source/destination addresses and ports back into your original objects. The numbers in ...


6

Based on the wildcard mask you've specified within the access-list above (which permits only ip addresses from 10.10.10.0-10.0.0.7 rest would be implicitly denied),yes you will need to change the wildcard mask from 7 to 15 which would allow the newly added systems to communicate to the internet. Else they'd be denied by the implicit deny rule of ACL and no ...


6

That 3K and 9K platforms don't really have a notion of software switching. If it can't be programmed in the forwarding ASIC then it's not forwarded. There are a couple of minor exceptions but for standard unicast/multicast forwarding it's going to either go in hardware or not at all. This, incidentally, is why the number of ACL's supported on these ...


6

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (by just saying "no" on its only line). What you need to do is: clear config access-list out2in This will disassociate the access-list with the interface and ...


5

To block an unacceptable website you would normally use a proxy server or web filtering firewall. Either by forcing everybody to use the proxy and blocking the normal access to the web or use a firewall and block the offending URL(s). Using IP addresses is never a good option for websites as these addresses can change very often for big sites (when they ...


5

I was doing some playing with FPM and I think it may do what you're looking for: load protocol system:fpm/phdf/ether.phdf load protocol flash:/fpm/phdf/ipv6.phdf ! class-map type stack match-all cm-ipv6  match field ETHER type eq 0x86DD next IPV6 class-map type access-control match-all cm-ipv6-facebook  match start IPV6 dest-addr offset 9 size 4 eq ...


5

The direction is always in reference to the router itself. In your example, you have applied the ACL inbound on E0/0. So the ACL applies to traffic from the source entering the router on E0/0. Which direction you apply the ACL depends on what you are trying to do. But generally, it is better to filter as close to the source as possible. There's no ...


5

Your problem is, indeed, with routing. Things in VLAN 1 are using 5.1 as the gateway, right? 5.1 doesn't know about any other internal networks. (i.e. VLAN 10) Likewise, the hosts in VLAN 1 don't know about VLAN 10. When clientA tries to ping serverA, the packets go to the ASA and die as it doesn't know where to send them. (it's default route would send ...


Only top voted, non community-wiki answers of a minimum length are eligible