cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2546
Views
0
Helpful
18
Replies

Internet Only ACL - gets good IP but no web access

wavess
Level 1
Level 1

Hi All

 

Second post on here.  

 

trying to create an ACL for internet only.  

applied it inbound to the vlan interface.  

pcs get good ip, dns, and gateway.  

pcs cannot get on the web. (www traffic)

 

I read up on this and thought this ACL was correct, but I am having problems at two locations.  

 

maybe I can run wire shark on something to figure out what is happening, or show logs at some point?

 

the access ports are on a cisco catalyst 9200 switch.  the vlan interface is on a distribution switch that the access switch is uplinked to.  

 

i'm probably missing some output you might need...please advise!  I'm new to this stuff.  any thoughts would be appreciated.  sorry if this is so basic.

 

Extended IP access list INTERNET_ONLY
10 permit udp any any eq bootps
20 permit udp any any eq domain
30 permit tcp any any eq domain
40 permit tcp any any eq www
50 permit tcp any any eq 443

18 Replies 18

Joseph W. Doherty
Hall of Fame
Hall of Fame

So this ACL is applied to the SVI(s) hosting the VLAN you're trying to control?

This ACL is applied for SVI ingress, egress or both?

BTW, @Richard Burts makes an excellent suggestion, i.e. suffixing a "deny any any log" onto your ACL, and checking your device's log (although this also assumes logging is enabled and saving results, somewhere).

Also BTW, I'm way, way out-of-date on current HTTP programs, so although it's always been true you can use "non-standard" ports for HTTP and HTTPS, I wondering if after initial contact, with server, server can cause client to use a non-standard destination port (to the server).

 

I wondering if after initial contact, with server, server can cause client to use a non-standard destination port (to the server).

 

Nope and if it did that would pretty much break the internet or at the very least make firewalls redundant. 

 

Jon

Jon, I'll take your "nope" as a correct answer, as I noted, I'm not current in HTTP/HTTPS, but as for it breaking the Internet or making firewalls redundant, what I was wondering is whether HTTP/HTTPS might have evolved an option (somewhat) like FTP's passive mode, i.e. first contact from client to server uses random client port and known/standard server port (80/443), but initial reply from server provides a new port number, on server, for client to use to continue the session.

If HTTP/HTTPS was doing something like this, the ACL, that looks good, would block the next outgoing HTTP/HTTPS packet.

More likely, though, it's something "simple", although as noted by others, more information would be very useful.

PS:

Oh, for anyone wondering would such a "dynamic" HTTP/HTTPS port change block such traffic on a firewall, maybe, maybe not.  First, FW are often more "watchful" about what's trying to come in from the "outside", rather than internal traffic going out.  Or, FWs, unlike basic ACLs, often inspect packets more deeply than ACLs, somewhat similar to what Cisco's NBAR might do.

Lastly, I have seen FWs break some new forms of traffic, until the FW software is updated.  (Or, another example, "pure" PAT, without some form of embedded "fixups" breaks many protocols.  Years ago, people often wondered why their Enterprise router would break some forms of Internet traffic, when you enabled PAT, but their home "router", also doing PAT, worked just fine.)

wavess
Level 1
Level 1

Richard, Joseph, Kasun, Jon, Balaji.  

 

Thank you to all of you.  I am posting this as the accepted solution.  I do not know what I did to make this work, because nothing really changed.  Perhaps my boss was doing something wrong when he was checking for internet connectivity on ports in the internet only vlan.  

 

The ACL is applied inbound on the vlan interface using the access-group in command.  the ACL is created in global config and is listed below.  hopefully this helps someone else.  Thanks again!

 

ACL:

Extended IP access list INTERNET_ONLY
10 permit udp any any eq bootps
20 permit udp any any eq domain
30 permit tcp any any eq domain
40 permit tcp any any eq www
50 permit tcp any any eq 443