@Mark Alpha wrote:
, then i found the community , i m really happy that there is this community
Yea, it's fantastic. Before I ever contributed, I learned a lot from reading various posts, still do.
For you, when you post a question, also make clear what you're looking for, regarding an answer.
For example, in this case, as well done in the earlier replies, "here's how it's done" were well provided.
In my case, since you mentioned you're "learning", possibly with the intent to obtain a CCNA, I broadened my reply to help you "learn", so you might not only answer a certification question, but also can do it for real, in the real-world.
For (hopefully) more learning . . .
Your two stated requirements are:
- extended acls can i make admin to communicate with sales and IT
- (and) block the communication between sales and IT
Again, for the above you could use standard ACLs too, and it's worthwhile knowing how, and how it compares with extended ACLs doing the same.
Regarding analysis of your requirements, as by default, everything can communicate with everything (assuming we're not explicitly blocking, and network is built for that [e.g. routing between subnet, etc.}), minimally we only need to block communication between sales and IT.
Also in networking, communication often implies two way, but one way is possible. I.e. if we block just one way, is that sufficient, as it blocks two way, or do we need to explicitly block two way?
As ACLs are usually applied on L3 interfaces, the logical places we normally consider are egress or ingress at the leaf/end subnets or transit L3 interfaces. Also remember, ACLs may be applied for ingress and/or egress traffic, per interface.
In your case, there are no transit interfaces.
If we consider the Sales interface and the IT interface. . .
On the Sales interface, we want to block IT traffic being sent to it, and the converse for the IT interface.
ip access-list standard BlockIT
deny 192.168.30.0 0.0.0.255
permit any
ip access-list standard BlockSales
deny 192.168.20.0 0.0.0.255
permit any
int g0/0.20
ip access-group BlockIT out
int g0/0.30
ip access-group BlockSales out
Remember, analysis of requirements?
What if we did:
ip access-list standard AllowAdmin
permit 192.168.10.0 0.0.0.255
int g0/0.20
ip access-group AllowAdmin out
int g0/0.30
ip access-group AllowAdmin out
Do both of the above configs, cover the requirements?
Which is "better"?
Might we have another variation, some combination of the two, above, approaches?
Can you rewrite the above using extended ACLs?
If we use extended ACLs, should the ACLs be further modified and/or placed differently? If so, why?
(NB: BTW, ideally, ACLs should drop ASAP, to avoid passing along traffic that we know is going to be dropped later, but, in real-world, ease of maintenance might be considered?
Advanced consideration: what about FW like filtering, i.e. admin is allowed to open communication with IT or Sales, but neither can open communication with Admin?
