03-30-2022 06:42 AM
Hi All
Second post on here.
trying to create an ACL for internet only.
applied it inbound to the vlan interface.
pcs get good ip, dns, and gateway.
pcs cannot get on the web. (www traffic)
I read up on this and thought this ACL was correct, but I am having problems at two locations.
maybe I can run wire shark on something to figure out what is happening, or show logs at some point?
the access ports are on a cisco catalyst 9200 switch. the vlan interface is on a distribution switch that the access switch is uplinked to.
i'm probably missing some output you might need...please advise! I'm new to this stuff. any thoughts would be appreciated. sorry if this is so basic.
Extended IP access list INTERNET_ONLY
10 permit udp any any eq bootps
20 permit udp any any eq domain
30 permit tcp any any eq domain
40 permit tcp any any eq www
50 permit tcp any any eq 443
Solved! Go to Solution.
03-30-2022 08:59 AM
So this ACL is applied to the SVI(s) hosting the VLAN you're trying to control?
This ACL is applied for SVI ingress, egress or both?
BTW, @Richard Burts makes an excellent suggestion, i.e. suffixing a "deny any any log" onto your ACL, and checking your device's log (although this also assumes logging is enabled and saving results, somewhere).
Also BTW, I'm way, way out-of-date on current HTTP programs, so although it's always been true you can use "non-standard" ports for HTTP and HTTPS, I wondering if after initial contact, with server, server can cause client to use a non-standard destination port (to the server).
03-30-2022 09:17 AM
I wondering if after initial contact, with server, server can cause client to use a non-standard destination port (to the server).
Nope and if it did that would pretty much break the internet or at the very least make firewalls redundant.
Jon
03-30-2022 02:47 PM - edited 03-30-2022 03:02 PM
Jon, I'll take your "nope" as a correct answer, as I noted, I'm not current in HTTP/HTTPS, but as for it breaking the Internet or making firewalls redundant, what I was wondering is whether HTTP/HTTPS might have evolved an option (somewhat) like FTP's passive mode, i.e. first contact from client to server uses random client port and known/standard server port (80/443), but initial reply from server provides a new port number, on server, for client to use to continue the session.
If HTTP/HTTPS was doing something like this, the ACL, that looks good, would block the next outgoing HTTP/HTTPS packet.
More likely, though, it's something "simple", although as noted by others, more information would be very useful.
PS:
Oh, for anyone wondering would such a "dynamic" HTTP/HTTPS port change block such traffic on a firewall, maybe, maybe not. First, FW are often more "watchful" about what's trying to come in from the "outside", rather than internal traffic going out. Or, FWs, unlike basic ACLs, often inspect packets more deeply than ACLs, somewhat similar to what Cisco's NBAR might do.
Lastly, I have seen FWs break some new forms of traffic, until the FW software is updated. (Or, another example, "pure" PAT, without some form of embedded "fixups" breaks many protocols. Years ago, people often wondered why their Enterprise router would break some forms of Internet traffic, when you enabled PAT, but their home "router", also doing PAT, worked just fine.)
04-18-2022 05:23 AM
Richard, Joseph, Kasun, Jon, Balaji.
Thank you to all of you. I am posting this as the accepted solution. I do not know what I did to make this work, because nothing really changed. Perhaps my boss was doing something wrong when he was checking for internet connectivity on ports in the internet only vlan.
The ACL is applied inbound on the vlan interface using the access-group in command. the ACL is created in global config and is listed below. hopefully this helps someone else. Thanks again!
ACL:
Extended IP access list INTERNET_ONLY
10 permit udp any any eq bootps
20 permit udp any any eq domain
30 permit tcp any any eq domain
40 permit tcp any any eq www
50 permit tcp any any eq 443
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide