topic Re: Configure Access-list to protect IP address in Routing and SD-WAN

Configure Access-list to protect IP address

megahostzone — Tue, 05 Mar 2019 04:52:00 GMT

I have connected around 30 server with 2 cisco 2950 switch. the switch are connected to a mikrotik router. I am doing BGP with /24 IP address provided by APNIC. I have enabled DHCP in the router so that each server can get an IP automatically. Some of client have additional ip address too. they are configured manually. now how can i protect ip address to be stolen from client. One suggest me to configure ACL so that no IPs can be "stolen". Client can access only the IP allow them in switch.

So please give me a example how to configure it. if my address block is xxx.yyy.zzz.0/24

thanks in advance

Re: Configure Access-list to protect IP address

Lei Tian — Mon, 26 Aug 2013 10:41:00 GMT

Hi Santu,

Can you put client and server in different VLAN?

HTH,
Lei Tian

Sent from Cisco Technical Support iPhone App

Re: Configure Access-list to protect IP address

Karsten Iwen — Mon, 26 Aug 2013 10:43:49 GMT

There are two ways to achieve it, but the first and better way is only available on newer switches.

1) Using DHCP-Snooping and IP Source-Guard

The switch monitors the DHCP-comunication from the client to the server and limits the communication to only that IP that was assigned by the DHCP-server. Additional IPs can be configured manually. These functions add some more security-measures that are very usefull in environments with untrusted clients. So if there is a chance to upgrade your switch to at least a 2960, then go for it.

2) Using port-ACLs where only the IP of the server is allowed as a source. That could look like the following and works also with older switches:

ip access-list standard Server1

permit host 10.10.10.1

ip access-list standard Server2

permit host 10.10.10.11

permit host 10.10.10.12

interface fast 0/1

description Server1

ip access-group Server1 in

interface fast 0/2

description Server2

ip access-group Server2 in

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Re: Configure Access-list to protect IP address

megahostzone — Mon, 26 Aug 2013 11:14:43 GMT

I don't want to use vlan as its waste of IP Address i have only /24 IP block