Cisco ACL confusion...

jonathanaxford · ‎10-29-2007

Hi All,

I have a couple of queries about the way ACLs work on Cisco Layer 3 switches... Namely a Cisco 6509 with IOS 12.2(18)

We have a number of VLANs running on the device and after creating a new 'Management' VLAN, we wanted to restrict access to this VLAN so only 2 out of our 20+ other VLANs could access the devices within.

Now, sounds fairly simple to me. BUT, we could only get it to work properly if we denied access form ALL 18 of ther other VLAN interfaces and not by placing a much smaller ACL at the Destination VLAN interface.

Does this make sense? Can anyone tell me if they should work the same as a PIX/Router ACL? Here is an example:

The Management VLAN is VLAN 8 with a network address of 172.17.1.0/24, the ACL is 180. Lets say we want to allow networks 172.23.80.0/24 and 172.19.0.0/16 to access the new VLAN, but NO others.

access-list 180 permit ip 172.23.80.0 0.0.0.255 172.17.1.0 0.0.0.255

access-list 180 permit ip 172.19.0.0 0.0.255.255 172.17.1.0 0.0.0.255

access-list deny ip any any

int vlan 8

ip access-group 180 in

Would this be on the right lines or am i missing something?

Many thanks

Jon Marshall · ‎10-29-2007

Hi Jonathan

Nothing wrong with the acl but you have applied in the wrong direction.

In is traffic coming from the management vlan going to other vlans.

Out is traffic going onto the management vlan from other vlans.

Try applying the access-list out and see what happens

int vlan 8

ip access-group 180 out

HTH

Jon

jonathanaxford · ‎10-29-2007

Hi Jon,

Many thanks for this. The way i understood it is that an 'IN' statement applied to traffic going INTO the VLAN and an 'OUT' statement applied to traffic leaving the VLAN.

So, with VLAN interfaces, it is the other way round?

Jon Marshall · ‎10-29-2007

Jonathan

Think of it like this.

IN statement applies to traffic going into the interface rather than the vlan so in your example IN on vlan 8 means traffic going into the vlan 8 interface ie. traffic from vlan 8 servers.

OUT applies to traffic leaving the interface ie. traffic going out on vlan 8 interface - to the vlan 8 servers.

Hope this makes sense

Jon

jonathanaxford · ‎10-29-2007

Hi Jon,

It does make sense! I was using the VLAN interfaces as 'Physical' interfaces, which obviously they are not.

I will give this a try in one of our test VLANs and see what happens.

Thank again,

Jonathan