cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
436
Views
3
Helpful
3
Replies

Access-list for response port

chpmotry
Level 1
Level 1

Hi guys.

I have a network with below topology :

Capture.JPGServer vlan two should can only answer the remote request of server vlan three and has no other permissions. Server vlan three should is unlimited access

I typed below commands in switch-core of my top topology 

ip access-list extended acl-vl2

permit tcp host 172.16.2.2 host 172.16.3.2 eq 3389 established 

deny ip any any 

int vlan 2

ip add 172.16.2.1 255.255.255.0

ip acces-group acl-vl2 in

int vlan 3

ip add 172.16.3.1 255.255.255.0

But result of this commands was that the server vlan 2 could  still remoting to server vlan 3?

I tested the below command :

ip access-list extended acl-vl2

 

permit tcp host 172.16.2.2 host 172.16.3.2 established 

 

deny ip any any 

but the result did not change .

What command i should typing to fix this problem?

 

1 Accepted Solution

Accepted Solutions

M02@rt37
VIP
VIP

Hello @chpmotry 

 

Server vlan two should can only answer the remote request of server vlan three and has no other permissions.

ip access-list extended acl-vl2

permit tcp host 172.16.2.2 eq 3389 host 172.16.3.2 

deny ip any any 

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

View solution in original post

3 Replies 3

M02@rt37
VIP
VIP

Hello @chpmotry 

 

Server vlan two should can only answer the remote request of server vlan three and has no other permissions.

ip access-list extended acl-vl2

permit tcp host 172.16.2.2 eq 3389 host 172.16.3.2 

deny ip any any 

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

"Server vlan two should can only answer the remote request of server vlan three and has no other permissions."

What M02@rt37 provided for the ACE is likely "good enough", but you might further tighten it with a variation from OP, i.e.:

permit tcp host 172.16.2.2 eq 3389 host 172.16.3.2 established 

Also as request was just to block the VLAN 2 server, you might also change:

deny ip any any !also blocks all other hosts on that VLAN

to:

deny ip host 172.16.2.2 any !Of course, still keeping the prior permit ACE too.
permit ip any any

 

Thank you so much @Joseph W. Doherty

I test your commands and recommendation.

Review Cisco Networking for a $25 gift card