ACL on c9300 issue

[dragonhunt9111]

Hi friends,

I have switch 9300 in simple topology like this:

PC admin -----------(int vlan 40)c9300-(int vlan 60)--------Vcenter

I create an ACL on C9300 to allow only PC admin access vcenter web gui

ip access-list extended Vcenter 

permit ip host 172.30.40.100 host 172.30.60.100

deny ip any any

exit

int vlan 60

ip access-group Vcenter  out

exit

From PC can telnet 443 and access web gui on vcenter. But problem is after accessing webgui of vcenter, I press button launch HTML

It loading forever...and not show login screen.

Then I try edit ACL , change source to any:

permit ip host 172.30.40.100 host 172.30.60.100 =>change to: permit ip any host 172.30.60.100

Then it access vcenter without above problem.

I try to edit source of ACL to full subnet of company (172.30.0.0/16) but also not work, only if source is any , it works.

Please have any ideals, thanks you!!

[M02@rt37]

Hello @dragonhunt9111 

You can enable logging to see if there are denied packets. This can help identify if there are additional ports or protocols being used by the vCenter that are being blocked.

ip access-list extended Vcenter
permit ip any host 172.30.60.100 log
deny ip any any log

Then check the logs to see if any packets are being denied that might be related to the issue.

[dragonhunt9111]

Dear,

Finally, I found the cause, it is because Vcenter behavior, 

when from PC access web gui of vcenter, then vcenter will call DNS server , then DNS server reply vcenter, and get droped by ACL (which only permit IP of my PC) - I dont know why vcenter acts like that.

I found it call DNS server when debugging ip packet on switch 9300.

Thank all

[Richard Burts]

Thanks for sharing your experience and the explanation of the issue and how you found it. Other participants in the community may find this helpful.

[paul driver]

Hello
Looking at the acl you had it applied the wrong away around, svi acl logic is:

Inside = originating from within the vlan
Outside = originating outside the vlan

So the below should acl work specifying a single host.

ip access-list extended Vcenter
permit ip host 172.30.60.100 host 172.30.40.100
exit

int vlan 60
ip access-group Vcenter IN