ACL and VLAN interface Cisco SG300

[chiprule]

Hi Guys,

I have a question about acl and vlan interface.

I create test environment as follow:

Cisco SG300 in Layer 3 Mode

Vlan: 1

IP interface: 172.16.1.2/30

"This is transit network to pfsense"

Vlan: 200

IP interface: 192.168.100.0/24

"This is clients VLAN"

PFsense

IP: 172.16.1.1/30

"Firewall"

I create others vlan too, but they aren't relevant now.

My goal is to isolate vlan 200 from other vlans both inbound and outbound, and grant access to internet.

I set this rule in ACL

My question is, why I must explicit permit interface from 192.168.100.254/24 to 192.168.100.0/24 and viceversa to get access to this int from my host in the same vlan?

Thanks

[agekov]

  Hello  chiprule,

Hope you are doing well!

My name is Anton and I am working in the Cisco Small Business Support Team.

I would suggest that rules 14 and 15 are quite general and deny traffic within the VLAN 200 (192.168.100.0/24 subnet also will be included in this rule ).

That is why you need to explicitly permit interface from 192.168.100.254/24 to 192.168.100.0/24 and viceversa to get access to this int.

You can test with disabling those rules 14 and 15 and check if your traffic within the VLAN will be permitted without creating explicit rules. 

Kind Regards!

[chiprule]

Hi @agekov ,

thank you so much for your prompt reply.

I disabled rule: 7, 8, 14, 15, because disabling only 14 and 15 it doesn't make sense testing it.

Result:

I can reach vlan interface 192.168.200.254 from a host of the same vlan (in this case 192.168.200.100).

I can reach other 192.16.0.0/16 subnets, (this is not my goal)

From what I understood from Cisco acl, you must do explicit permit to interface if you deny RFC1918 or "deny any" in order to reach this interface from same vlan, correct?

[agekov · Accepted solution]

    Hello @chiprule ,

Thank you for the update.

Yes, you will need explicit permit rule to reach interface in the same vlan, because the "deny any" rule will deny the traffic within the same vlan included.

Kind Regards! 

[chiprule]

Hi @agekov 

thanks for support!