05-03-2023 05:01 PM
So I have ospf set up and I'm following directions that say to "Configure ACLs so that the 172.16.2.0/24 environment can reach your whole environment, but everyone else can only reach your 99 on the web ports." So from what I understand is everyone on the 10.0.0.0 network should only be allowed on interface 1.99 and blocked on everything else, and 172.16.2.0 should be able to access everything. I've tried making the ACLs but the problem is I'm denying the whole 10.0.0.0 network which includes me so I'm blocking myself, I'm on 10.218.0.0.How do I deny everyone else on the network besides myself? I attached the show run of my router so you can see my configuration.
05-03-2023 05:13 PM
because you apply the ACL in all interface and reason I think you do that is direction which is OUT
instead change the direction and apply ACL only to interface that this subnet direct connect
05-03-2023 05:45 PM
Hi
At which interface you are connected to ?
05-03-2023 06:11 PM
The router is connected to the switch through g0/0/1 and I'm using sub interfaces on g0/0/1 correlated to the switch vlans.
05-03-2023 06:38 PM - edited 05-03-2023 06:39 PM
Right, but you are at some subinterface. which one? Which IP address are you with ?
05-03-2023 06:40 PM
Well the PC is using sub interface 10 if that's what you mean.
05-03-2023 06:47 PM
you mean, you are here?
!
interface GigabitEthernet0/0/1.10
encapsulation dot1Q 10
ip address 10.218.10.1 255.255.255.0
ip helper-address 10.218.20.8
ip access-group 1 out
!
05-03-2023 06:55 PM
Well that is the sub interface that the PC is receiving it's address from so I guess so, if that's what you're asking. What exactly do you mean am I there? Kind of confused what you're asking.
05-03-2023 07:10 PM
Let me explain. If you are at this subinterface, and considering you should not drop the access, either you do not apply ACL to this subinterface or you add a specific rule for you PC.
if you create an Access list like this.
access-list 1 permit ip host 10.218.10.X any (replace X by your IP)
Considering that the ACL already have a deny any any implicit, you are allowing only you to access everything from this subinterface
05-03-2023 09:25 PM
One thing I'm confused about though is how can I permit myself and 172.16.2.0 at the same time on an interface while denying everyone else? Far as I can tell you can only permit 1 address per acl
05-04-2023 04:35 AM
If you permit one address you on the ACL, everything else will be denied as the ACL have a "deny any any" at the end.
05-04-2023 03:26 AM
access-list 100 permit tcp <IP><IP> eq www established
access-list 100 deny <ip><ip>
access-list 100 permit ip any any
this can solve your issue
the router only allow the traffic initiate inside you network to WEB in subnet you need to block
the direction of this ACL is IN
05-04-2023 05:28 AM - edited 05-04-2023 05:28 AM
For some reason it doesn't let me do the established at the end, says invalid input. Only lets me do any or host
05-04-2023 05:39 AM
show me the acl command
05-04-2023 05:45 AM
access-list 100 permit tcp 10.0.0.0 0.0.0.255 eq www established
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide