topic Re: Rules on portchannel in Network Security

Rules on portchannel

mware444 — Tue, 07 Sep 2021 15:01:25 GMT

Hi All

If you have a portchannel, with multiple sub-interfaces can you apply a rule to the portchannel with a view to applying that rule to ALL sub-interfaces ?

Re: Rules on portchannel

Milos_Jovanovic — Wed, 08 Sep 2021 07:07:07 GMT

Hi @mware444,

No, it is not. Once you decide to go with subinterfaces, port-channel as an entity is just a transport medium, and it has no logical configuration (like nameif, IP address, security-level, etc.).

BR,

Milos

Re: Rules on portchannel

Marius Gunnerud — Wed, 08 Sep 2021 08:16:47 GMT

You did not say which firewall you are using.

On ASA you can add the access rule to the global access list, this will then apply to all traffic entering the ASA.

On Firepower you would need to specify the security zones you wish to apply the rule to, otherwise you could use the any keyword and then it would apply to all security zones.

Re: Rules on portchannel

mware444 — Wed, 08 Sep 2021 15:03:30 GMT

Thanks Marius

It is an ASA and I didn't want to use the global option as the portchannel I am referring to, is for sub interfaces on the internal side only.

Mike

Re: Rules on portchannel

Marvin Rhoads — Wed, 08 Sep 2021 17:43:03 GMT

in that case, sure. Each subinterface would have a nameif and the access-group command applies a unique access list to that interface. You typically use a unique ACL per interface (subinterface in this case).

Re: Rules on portchannel

Milos_Jovanovic — Wed, 08 Sep 2021 17:50:44 GMT

But now that you mentioned it @Marvin Rhoads, a potential solution could be one ACL applied to all subinterfaces relevant to this port-channel.

Not a very common solution, but I believe it could do the trick in this case, with these requirements.

BR,

Milos

Re: Rules on portchannel

Marvin Rhoads — Wed, 08 Sep 2021 18:01:43 GMT

Yes I was thinking about that as well @Milos_Jovanovic .

It's rarely applicable since there are almost always other unique ACEs that you would want to include in the ACL for a given interface.