I have the configurations in the Nexus core switches from the previous engineer setup. I would like to ask something about the flow of the traffic. So it can allow me to do some access control between VLANs. Below attached are part of the ACLs that I have omitted most of them.
Currently the ACL defined. It applied to a few VLANs. Now a system has been installed inside the VLAN142 with ip 10.10.142.xxx. Other end user (e.g. 10.10.184.xxx) from the other VLANs would like to access to the machine with certain ports to be opened.
Now I am struggling on how to interpret the ACLs IN on the VLANs. After I understand more in details, I can configure the switch.
More clear about the ACLs on VLANs, as well as the parameter "established". Basically the "IN" is the control those traffic get into the VLANs that are under the specific subnet. Quite meaningful.
Will definitely worth for a trial on these commands. I also tested on the parameter at the end on certain protocols (e.g. RDP) with the "LOG" at the back to see how the traffic hits the ACLs.
110 permit ip 10.10.16.0 0.0.1.255 10.10.4.0 0.0.3.255
120 permit ip 10.10.16.0 0.0.1.255 10.10.16.0 0.0.1.255
130 permit ip 10.10.16.0 0.0.1.255 10.10.142.0 0.0.0.255
140 permit ip 10.10.16.0 0.0.1.255 10.10.144.0 0.0.7.255
150 permit ip 10.10.16.0 0.0.1.255 10.10.61.128 0.0.0.31
160 permit ip 10.10.16.0 0.0.1.255 10.10.0.48/32
170 permit ip 10.10.142.0 0.0.0.255 10.10.4.0 0.0.3.255
180 permit ip 10.10.142.0 0.0.0.255 10.10.16.0 0.0.1.255
190 permit ip 10.10.142.0 0.0.0.255 10.10.144.0 0.0.7.255
200 permit ip 10.10.142.0 0.0.0.255 10.10.61.128 0.0.0.31
210 permit ip 10.10.142.0 0.0.0.255 10.10.0.48/32
300 permit tcp any 10.10.0.1/32 eq domain
310 permit tcp any 10.10.183.0/24 established
320 permit tcp any 10.10.183.0/24
330 permit udp 10.10.142.41/32 eq ntp any
340 permit udp 10.10.142.43/32 eq ntp any
interface Vlan142
description PROD Vlan
no shutdown
ip access-group SYSTEMS in
ip address 10.10.142.250/24
interface Vlan26
no shutdown
mtu 9216
ip access-group SYSTEMS in
ip address 10.10.16.250/24
The SVi ACL logic IN = traffic originating from within the vlan needing to exit its vlan OUT = traffic originating outside the vlan wanting to enter the vlan
Looking at your posted ACL, its applied inbound on two SVI's (vlan142 - 10.10.142.0/24 , vlan 26 10.10.16.0/24) So any access-list control entry (ACE) beginning with (any, 10.10.142.x, or 10.10.16.x) with be matched for those two vlans
As for the other non matching ACEs ( they will ONLY be matched if they reside within the vlan the ACL is applied.to.
Please rate and mark as an accepted solution if you have found any of the information provided useful. This then could assist others on these forums to find a valuable answer and broadens the communityās global network.
Kind Regards Paul
Learn, share, save
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
