Rules on portchannel

[mware444]

Hi All

If you have a portchannel, with multiple sub-interfaces  can you apply a rule to the portchannel with a view to applying that rule to ALL sub-interfaces ?

[Milos_Jovanovic]

Hi @mware444,

No, it is not. Once you decide to go with subinterfaces, port-channel as an entity is just a transport medium, and it has no logical configuration (like nameif, IP address, security-level, etc.).

BR,

Milos

[Marius Gunnerud · Accepted solution]

You did not say which firewall you are using.

On ASA you can add the access rule to the global access list, this will then apply to all traffic entering the ASA.

On Firepower you would need to specify the security zones you wish to apply the rule to, otherwise you could use the any keyword and then it would apply to all security zones.

[mware444]

Thanks Marius

It is an ASA and I didn't want to use the global option as the portchannel I am referring to, is for sub interfaces on the internal side only.

Mike

[Marvin Rhoads]

in that case, sure. Each subinterface would have a nameif and the access-group command applies a unique access list to that interface. You typically use a unique ACL per interface (subinterface in this case).

[Milos_Jovanovic]

But now that you mentioned it @Marvin Rhoads, a potential solution could be one ACL applied to all subinterfaces relevant to this port-channel.

Not a very common solution, but I believe it could do the trick in this case, with these requirements.

BR,

Milos

[Marvin Rhoads]

Yes I was thinking about that as well @Milos_Jovanovic .

It's rarely applicable since there are almost always other unique ACEs that you would want to include in the ACL for a given interface.