Cisco ACL confusion...

Unanswered Question
Oct 29th, 2007
User Badges:
  • Bronze, 100 points or more

Hi All,


I have a couple of queries about the way ACLs work on Cisco Layer 3 switches... Namely a Cisco 6509 with IOS 12.2(18)


We have a number of VLANs running on the device and after creating a new 'Management' VLAN, we wanted to restrict access to this VLAN so only 2 out of our 20+ other VLANs could access the devices within.


Now, sounds fairly simple to me. BUT, we could only get it to work properly if we denied access form ALL 18 of ther other VLAN interfaces and not by placing a much smaller ACL at the Destination VLAN interface.


Does this make sense? Can anyone tell me if they should work the same as a PIX/Router ACL? Here is an example:


The Management VLAN is VLAN 8 with a network address of 172.17.1.0/24, the ACL is 180. Lets say we want to allow networks 172.23.80.0/24 and 172.19.0.0/16 to access the new VLAN, but NO others.


access-list 180 permit ip 172.23.80.0 0.0.0.255 172.17.1.0 0.0.0.255

access-list 180 permit ip 172.19.0.0 0.0.255.255 172.17.1.0 0.0.0.255

access-list deny ip any any


int vlan 8

ip access-group 180 in


Would this be on the right lines or am i missing something?


Many thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Jon Marshall Mon, 10/29/2007 - 02:50
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi Jonathan


Nothing wrong with the acl but you have applied in the wrong direction.


In is traffic coming from the management vlan going to other vlans.


Out is traffic going onto the management vlan from other vlans.


Try applying the access-list out and see what happens


int vlan 8

ip access-group 180 out


HTH


Jon

jonathanaxford Mon, 10/29/2007 - 03:04
User Badges:
  • Bronze, 100 points or more

Hi Jon,


Many thanks for this. The way i understood it is that an 'IN' statement applied to traffic going INTO the VLAN and an 'OUT' statement applied to traffic leaving the VLAN.


So, with VLAN interfaces, it is the other way round?

Jon Marshall Mon, 10/29/2007 - 03:08
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Jonathan


Think of it like this.


IN statement applies to traffic going into the interface rather than the vlan so in your example IN on vlan 8 means traffic going into the vlan 8 interface ie. traffic from vlan 8 servers.


OUT applies to traffic leaving the interface ie. traffic going out on vlan 8 interface - to the vlan 8 servers.


Hope this makes sense


Jon

jonathanaxford Mon, 10/29/2007 - 03:11
User Badges:
  • Bronze, 100 points or more

Hi Jon,


It does make sense! I was using the VLAN interfaces as 'Physical' interfaces, which obviously they are not.


I will give this a try in one of our test VLANs and see what happens.


Thank again,


Jonathan

Actions

This Discussion