ACL Help

[jwalton2]

Hi All,

Pretty new to networking so please bear with me.

We have a project that requires that all the devices to have access to the internet, but not the local network.

I have setup an extended ACL for this which seems to work fine:

10 deny ip 10.2.61.0 0.0.0.255 10.0.0.0 0.255.255.255 (363 matches)
20 permit ip any any (322 matches)

But now we also want a local license server on this VLAN so they can use an application, I have put the server on the VLAN and given it the IP of 10.2.61.100

Am I right in thinking I need to add a line below line 10 with the following:

8 permit ip 10.2.61.0 0.0.0.255 host 10.2.61.100

That seems correct to me but doesn't seem to work. Any help appreciated.

Joe

[ADP_89]

Hello Joe,

Where did you apply the ACL? Is it on the router(where the defaul gateway IP resides) or on any switch port connected to the servers?

Cheers,

ADP

[jwalton2]

ACL is applied to the router where the default gateway resides. 

Vlan 61 is setup on the router and the switch that the devices are connected to.

[ADP_89]

So I am not sure how you achieved to block intra-subnet communications as traffic should be inspected by that ACL only when it goes from inside to outside.

If you want to make sure that clients are not communicating between them but they must be able to talk to some other devices connected to the switch (like the router or this licensing server) you should really look for other technologies like private VLANs, VACL(Vlan ACL) or "switchport protected"

Any of the above will work, but depending on the switch and the topology some might not be available.

HTH,

ADP

[jwalton2]

Thank you both I will look into VACL then.

[Georg Pauwen]

Hello,

--> 8 permit ip 10.2.61.0 0.0.0.255 host 10.2.61.100

this applies to traffic from withing the same VLAN. What are you trying to achieve ? Typically, in an layer 3 ACL, source and destination should be in different subnets, otherwise, if you want to control traffic within the same subnet (VLAN), you would use a VLAN ACL. Can you clarify ?