topic ACL is not working in Network Access Control

ACL is not working

Mordecalex — Thu, 05 Jan 2023 05:11:15 GMT

Hi, i want to disallow vlan 10 and 30 addresses on request my web server with ACL on my router msa (rt_msa on my topology) but it is not working, it still successfully request my web server.

here is a little bit what i did on rt_msa:

access-list 110 deny tcp 172.130.128.0 0.0.0.63 host 10.0.0.2 eq 80

access-list 110 deny tcp 172.130.129.32 0.0.0.31 host 10.0.0.2 eq 80

access-list 110 permit tcp 172.130.129.0 0.0.0.31 host 10.0.0.2 eq 80

int g0/1

ip access-group 110 in

Any help? am i doing somthing wrong?

Re: ACL is not working

Shambhu-Kumar — Thu, 05 Jan 2023 06:10:29 GMT

Cold you try this way,

access-list 110 permit tcp 172.130.129.0 0.0.0.31 host 10.0.0.2 eq 80

access-list 110 deny tcp any any eq 80

int g0/1
ip access-group 110 in

Re: ACL is not working

MHM Cisco World — Thu, 05 Jan 2023 09:14:05 GMT

I can not open PKT but please apply the ACL to SVI of vlan.

Re: ACL is not working

Mordecalex — Thu, 05 Jan 2023 16:35:35 GMT

I did and still not working 😕

ACL is not working

Mordecalex — Thu, 05 Jan 2023 18:01:20 GMT

Hi, i want to disallow vlan 10 and 30 addresses on request my web server with ACL on my router msa (rt_msa on my topology) but it is not working, it still successfully request my web server.

here is a little bit what i did on rt_msa:

access-list 110 deny tcp 172.130.128.0 0.0.0.63 host 10.0.0.2 eq 80

access-list 110 deny tcp 172.130.129.32 0.0.0.31 host 10.0.0.2 eq 80

access-list 110 permit tcp 172.130.129.0 0.0.0.31 host 10.0.0.2 eq 80

int g0/1

ip access-group 110 in

Any help? am i doing somthing wrong?

here is what i have done in PKT

Re: ACL is not working

reginaldjohnson — Fri, 06 Jan 2023 01:31:43 GMT

try the command below. It's best to add the permit ACL at the top and the deny ACL at the bottom. In this case, only the permit ACL is required and deny all.

access-list 110 permit tcp 172.130.129.0 0.0.0.31 host 10.0.0.2 eq 80
no access-list 110 deny tcp 172.130.128.0 0.0.0.63 host 10.0.0.2 eq 80
no access-list 110 deny tcp 172.130.129.32 0.0.0.31 host 10.0.0.2 eq 80
access-list 110 deny any any