topic VLAN Interface IP protection - Opened Ports in Network Security

VLAN Interface IP protection - Opened Ports

Serpent2010 — Thu, 25 Aug 2022 14:37:47 GMT

Hello everyone,

Q1) How can I block ports such as 443 on the VLAN x interface IP?

1) I tried ACL on the Inbound & Outbound of the VLAN x but it does not work.

2) Physical router (who hosts the VLAN X interface IP) has been configured to allow port 443 BUT on the different VLAN the management VLAN. This allowed port 443 on the physical router management is used for the web management not for VLAN x.

Any advice, please

Re: VLAN Interface IP protection - Opened Ports

Rob Ingram — Thu, 25 Aug 2022 14:44:48 GMT

@Serpent2010 define an ACL permitting/denying the relevant traffic then assign that ACL to the http server - "ip http access-class ACL-NAME" that should restrict http/https server traffic on the device.

Re: VLAN Interface IP protection - Opened Ports

Serpent2010 — Thu, 25 Aug 2022 14:51:08 GMT

Thanks for the quick reply, and that's working for the physical box http/https config but it does not work for the interface VLAN X IP.

In other words, the ACL will work perfectly for the management VLAN but it does not work for the VLAN x

I can redo the test to double check, if you want me to do that

Re: VLAN Interface IP protection - Opened Ports

MHM Cisco World — Thu, 25 Aug 2022 15:39:12 GMT

If the traffic is direct to VLAN then ACL not work, the ACL work for traffic pass through VLAN SVI no traffic direct to VLAN SVI.
you need CoPP OR
check the ip route, see the traffic come from and apply ACL IN in the next-hop not in VLAN SVI.

Re: VLAN Interface IP protection - Opened Ports

Serpent2010 — Thu, 25 Aug 2022 16:16:06 GMT

You are correct and I will work on your suggestion, it is very interesting, to see if it will work as expected.

Many thanks

Re: VLAN Interface IP protection - Opened Ports

MHM Cisco World — Thu, 25 Aug 2022 16:31:26 GMT

You are so so welcome