10-29-2007 02:46 AM - edited 03-03-2019 05:30 AM
Hi All,
I have a couple of queries about the way ACLs work on Cisco Layer 3 switches... Namely a Cisco 6509 with IOS 12.2(18)
We have a number of VLANs running on the device and after creating a new 'Management' VLAN, we wanted to restrict access to this VLAN so only 2 out of our 20+ other VLANs could access the devices within.
Now, sounds fairly simple to me. BUT, we could only get it to work properly if we denied access form ALL 18 of ther other VLAN interfaces and not by placing a much smaller ACL at the Destination VLAN interface.
Does this make sense? Can anyone tell me if they should work the same as a PIX/Router ACL? Here is an example:
The Management VLAN is VLAN 8 with a network address of 172.17.1.0/24, the ACL is 180. Lets say we want to allow networks 172.23.80.0/24 and 172.19.0.0/16 to access the new VLAN, but NO others.
access-list 180 permit ip 172.23.80.0 0.0.0.255 172.17.1.0 0.0.0.255
access-list 180 permit ip 172.19.0.0 0.0.255.255 172.17.1.0 0.0.0.255
access-list deny ip any any
int vlan 8
ip access-group 180 in
Would this be on the right lines or am i missing something?
Many thanks
10-29-2007 02:50 AM
Hi Jonathan
Nothing wrong with the acl but you have applied in the wrong direction.
In is traffic coming from the management vlan going to other vlans.
Out is traffic going onto the management vlan from other vlans.
Try applying the access-list out and see what happens
int vlan 8
ip access-group 180 out
HTH
Jon
10-29-2007 03:04 AM
Hi Jon,
Many thanks for this. The way i understood it is that an 'IN' statement applied to traffic going INTO the VLAN and an 'OUT' statement applied to traffic leaving the VLAN.
So, with VLAN interfaces, it is the other way round?
10-29-2007 03:08 AM
Jonathan
Think of it like this.
IN statement applies to traffic going into the interface rather than the vlan so in your example IN on vlan 8 means traffic going into the vlan 8 interface ie. traffic from vlan 8 servers.
OUT applies to traffic leaving the interface ie. traffic going out on vlan 8 interface - to the vlan 8 servers.
Hope this makes sense
Jon
10-29-2007 03:11 AM
Hi Jon,
It does make sense! I was using the VLAN interfaces as 'Physical' interfaces, which obviously they are not.
I will give this a try in one of our test VLANs and see what happens.
Thank again,
Jonathan
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide