Securing 3750

Answered Question
Mar 30th, 2007
User Badges:
  • Blue, 1500 points or more

Hi,


If I configure HSRP in vlan interface, which is the best place to put the config below? Physical interface or vlan interface and why?


FYI, I put it in vlan interface because the routing information is there (i.e ip address and HSRP).


!

access-list 30 remark Multicast-filtering-ACL

access-list 30 deny 224.0.1.35 log

access-list 30 deny 224.0.1.60 log

access-list 30 deny 224.0.1.3 log

access-list 30 deny 224.0.1.2 log

access-list 30 deny 224.0.1.22 log

access-list 30 deny 224.0.1.24 log

access-list 30 deny 224.0.0.0 0.0.0.255 log

access-list 30 deny 239.0.0.0 0.255.255.255 log

access-list 30 permit 224.0.0.0 15.255.255.255 log

!

interface physical_or_vlan?

no ip redirects

no ip directed broadcast

no ip mask-reply

no ip unreachables

no ip proxy-arp

ip accounting access-violations

ip multicast boundary 30

no ip mroute-cache

ntp disable

no cdp enable



TIA



Correct Answer by Jon Marshall about 10 years 3 weeks ago

Hi Danilo


Not sure i fully understand. The layer 3 interface is the SVI so that is the logical place to put the layer 3 access-list that you have created.


When you say the physical interface which physical interface were you thinking of ?

If the physical interface was configured as a routed port then the access-list would go on there but this isn't what you have done.


Could you clarify ?


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Fri, 03/30/2007 - 00:27
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi Danilo


Not sure i fully understand. The layer 3 interface is the SVI so that is the logical place to put the layer 3 access-list that you have created.


When you say the physical interface which physical interface were you thinking of ?

If the physical interface was configured as a routed port then the access-list would go on there but this isn't what you have done.


Could you clarify ?


Jon

Danilo Dy Fri, 03/30/2007 - 00:39
User Badges:
  • Blue, 1500 points or more

Hi Jon,


Thanks for your reply.


I think you have answered my question. I just tried putting those config in the physical interface, it won't accept it if I don't put routing configuration on it.

Actions

This Discussion