Securing 3750

Answered Question
Mar 30th, 2007

Hi,

If I configure HSRP in vlan interface, which is the best place to put the config below? Physical interface or vlan interface and why?

FYI, I put it in vlan interface because the routing information is there (i.e ip address and HSRP).

!

access-list 30 remark Multicast-filtering-ACL

access-list 30 deny 224.0.1.35 log

access-list 30 deny 224.0.1.60 log

access-list 30 deny 224.0.1.3 log

access-list 30 deny 224.0.1.2 log

access-list 30 deny 224.0.1.22 log

access-list 30 deny 224.0.1.24 log

access-list 30 deny 224.0.0.0 0.0.0.255 log

access-list 30 deny 239.0.0.0 0.255.255.255 log

access-list 30 permit 224.0.0.0 15.255.255.255 log

!

interface physical_or_vlan?

no ip redirects

no ip directed broadcast

no ip mask-reply

no ip unreachables

no ip proxy-arp

ip accounting access-violations

ip multicast boundary 30

no ip mroute-cache

ntp disable

no cdp enable

TIA

I have this problem too.
0 votes
Correct Answer by Jon Marshall about 9 years 8 months ago

Hi Danilo

Not sure i fully understand. The layer 3 interface is the SVI so that is the logical place to put the layer 3 access-list that you have created.

When you say the physical interface which physical interface were you thinking of ?

If the physical interface was configured as a routed port then the access-list would go on there but this isn't what you have done.

Could you clarify ?

Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Fri, 03/30/2007 - 00:27

Hi Danilo

Not sure i fully understand. The layer 3 interface is the SVI so that is the logical place to put the layer 3 access-list that you have created.

When you say the physical interface which physical interface were you thinking of ?

If the physical interface was configured as a routed port then the access-list would go on there but this isn't what you have done.

Could you clarify ?

Jon

Danilo Dy Fri, 03/30/2007 - 00:39

Hi Jon,

Thanks for your reply.

I think you have answered my question. I just tried putting those config in the physical interface, it won't accept it if I don't put routing configuration on it.

Actions

This Discussion