Jon,

this looks like it might well be the answer. now I just need to work out what the syntax is.  the devices will be 172.20.23.100 & 172.20.23.105 and the UDP port is port 10006. I'd be happy to block all of this UDP traffic on the whole switch or just on the 2 ports in question whichever is most straightforward.

Tom

tom.last@tdl.ltd.uk
Jon,
this looks like it might well be the answer. now I just need to work out what the syntax is.  the devices will be 172.20.23.100 & 172.20.23.105 and the UDP port is port 10006. I'd be happy to block all of this UDP traffic on the whole switch or just on the 2 ports in question whichever is most straightforward.
Tom

Tom

Try this -

access-list 101 deny udp host 172.20.23.100 host 172.20.23.105 eq 10006

access-list 101 permit ip any any

access-list 102 deny udp host 172.20.23.105 host 172.20.23.100 eq 10006

access-list 102 permit ip any any

int gi0/1      <---- connected to 172.20.23.100, obviously you need to modify depending on which port the host is connected to

ip access-group 101 in

int gi0/2     <----- connected to 172.23.20.105 with same proviso as above

ip access-group 102 in

Jon

ok switch has arrived and I'm struggling a bit, I can only assign an IP address to either VLAN1 or one of the FastEthernet interfaces (not both), I believe that I need to have an IP address assigned to the interface in order to assign ACLs to that interface. This is evident when I try the IP ACCESS-GROUP command on an interface with no ip address the command is not available.

SO I created 2 ACLs:

access-list 101 deny udp any any eq 10006

access-list 101 deny tcp any any eq 10006

Message was edited by: Tom Last

As leo said... a layer 2 switch with know what an IP address is but only for management purposes

(to access the switch itself).

The layer 2 switch will not care about the IPs in terms of passing traffic because is not aware of routing.

Federico.

Leo / Federico

I could be wrong but as far as i know a L2 switch can filter on IP address. Have a look at the configuration guide i sent. A L2 switch does not have to be able to route to recognise IP addresses. Think of the fact that most L2 switches can recognise DSCP values which again are a L3 marking in the IP header.

Jon

Jon,

You're right! I've fortgotten completely about this.

You can configure ACLs based on L2, L3 or even L4 information on a L2 port on a L2 switch.

Definitely can give that a try.

If there's a layer 3 device I would do it there, if not can implement the ACLs on the L2 ports.

Federico.

Lousy time to quit Red Bulls before bed.  Me baaaaaaaaaaaaaaaaaaaaaaaad.