cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
400
Views
0
Helpful
1
Replies

Problem with ACL 3560G not block all traffic

zaikini_23
Level 1
Level 1

Hi!

I have SVI in my 3560G

!

interface Vlan304

ip address x.x.x.x 255.255.255.248 secondary

ip address y.y.y.y 255.255.255.248 secondary

ip address s.s.s.s 255.255.255.248 secondary

ip address z.z.z.z 255.255.255.248

ip access-group Vlan304-in in

and I block network s.s.s.s/29

sh ip access-lists Vlan304-in

Extended IP access list Vlan304-in

deny ip s.s.s.s 0.0.0.7 any

permit ip any any

I have seen in statistics (netflow) the proceeding traffic from this subnet. I have found out that it is inquiries udp on the destination port 5150.

I have changed access-list Vlan304-in:

sh ip access-lists Vlan304-in

Extended IP access list Vlan304-in

deny tcp s.s.s.s 0.0.0.7 gt 0 any gt 0

deny udp s.s.s.s 0.0.0.7 gt 0 any gt 0

permit ip any any

and traffic is stop from this subnet.

Why in the first case the access-list did not block all traffic?

1 Reply 1

vkapoor5
Level 5
Level 5

To my knlowledge the first ACL must work, because the first ACL statement will block all IP traffic for the segment. The problem might be the duplicate statment if you applied the first case and second case at a time. Because the access list will take the exact match.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: