ACL Question

[Shar_De]

Hello, how do I write an extended ACL that will match packets going to a destination not in its routing table or a destination on the internet (it can be destined to any public internet host).  Similar to a default route. 

[Jon Marshall]

Not sure I follow but to match any IP address - 

access-list 101 permit ip 192.168.3.0 0.0.0.255 any 

would allow any 192.168.3.x IP to send traffic to any IP. 

Jon

[Shar_De]

Here is the entire scenario :)

I need to test a few servers on a subnet using an alternate default route. 

Scenario - Currently, packets sourced from the vlans below use the statically defined routes below which points to a load balancer. I want to change both static routes to point to a FW, however, I do not know the ramifications of those changes, therefore, I would like to test with a couple of servers going through the FW first, then I can update the static routes.

I thought a PBR would work, but would like feedback on how to setup the route map ACLs. Specifically, how to configure the ACL to match a destination network similar to a default route. The test hosts will reside on vlan608 and I will configure two static routes that point to the FW (new static routes would be ip route 0.0.0.0/0 10.1.56.5 and ip route 10.1.40.0/21 10.1.56.5).

I am looking for an ACL that will match a subset of servers on vlan 184 with a destination of the "internet."  I would the test servers on vlan184 to use the new static routes. The current static routes will remain so that the other servers can use them, while I am testing the new routes.

Current Configuration

ip route 0.0.0.0/0 10.1.56.15
ip route 10.1.40.0/21 10.1.56.15

Vlan184 192.168.184.2 protocol-up/link-up/admin-up
Vlan608 192.168.8.2 protocol-up/link-up/admin-up
Vlan1056 10.1.56.5 protocol-up/link-up/admin-u

[Jon Marshall]

access-list 101 permit ip host 192.168.184.10 any
access-list 101 permit ip host 192.168.184.11 any
etc.

route-map PBR permit 10
match ip address 101
set ip next-hop 10.1.56.5

then apply the PBR route map to the vlan 184 SVI 

what the above does is send all traffic from those hosts to the firewall even traffic to other internal subnets but it will allow you to test the firewall setup. 

Jon

[Shar_De]

Thank you!!! Will try this out!!!