×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Guest VLAN ACL

Unanswered Question
May 9th, 2014
User Badges:

Can someone double check this ACL I wrote that is suppose to restrict traffic on a Guest VLAN from accessing anything on the internal network besides a few services (HTTP(s),DNS,DHCP).

I applied it directly to the VLAN SVI and it seems to work but I wanted a second opinion.

Thanks!

interface Vlan101
 ip access-group VLAN101-IPv4-In in
 ip access-group VLAN101-IPv4-Out out
ip access-list extended VLAN101-IPv4-In
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq domain
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq www
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 443
 permit udp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq domain
 permit udp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq bootpc
 deny   ip 172.16.101.0 0.0.0.255 172.16.1.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.2.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.100.0 0.0.0.255
 permit ip any any
ip access-list extended VLAN101-IPv4-Out
 permit tcp 172.16.10.0 0.0.0.255 eq domain 172.16.101.0 0.0.0.255
 permit tcp 172.16.10.0 0.0.0.255 eq www 172.16.101.0 0.0.0.255
 permit tcp 172.16.10.0 0.0.0.255 eq 443 172.16.101.0 0.0.0.255
 permit udp 172.16.10.0 0.0.0.255 eq domain 172.16.101.0 0.0.0.255
 permit udp 172.16.10.0 0.0.0.255 eq bootps 172.16.101.0 0.0.0.255
 deny   ip 172.16.1.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.2.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.100.0 0.0.0.255 172.16.101.0 0.0.0.255
 permit ip any any
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Richard Burts Fri, 05/09/2014 - 11:25
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

You have not provided information about the topology of the network so we are forced to make assumptions. Assuming that the Guest VLAN is vlan 101 and that the address of its subnet is 172.16.101.0/24 and that the internal network consists only of 172.16.1.0, 172.16.2.0, 172.16.10.0, and 172.16.100.0 then these access lists would be pretty effective in preventing devices on the Guest VLAN from communicating with the internal network other than DNS, HTTP, HTTPS, and DHCP, except that I believe that your logic for DHCP is flawed.

 

The in ACL will be looking for requests from clients to servers and so the port should be bootps rather than bootpc. And the out ACL will be looking for responses from server to client so you should be checking the destination port rather than the source port as your current ACL does, and the port should be bootpc.

 

HTH

 

Rick

FratianiD Fri, 05/09/2014 - 11:31
User Badges:

You are correct on the topology.

Thank you

Is this correct?

ip access-list extended VLAN101-IPv4-In
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq domain
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq www
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 443
 permit udp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq domain
 permit udp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq bootps
 deny   ip 172.16.101.0 0.0.0.255 172.16.1.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.2.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.100.0 0.0.0.255
 permit ip any any
ip access-list extended VLAN101-IPv4-Out
 permit tcp 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255 eq domain
 permit tcp 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255 eq www
 permit tcp 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255 eq 443
 permit udp 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255 eq domain
 permit udp 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255 eq bootpc
 deny   ip 172.16.1.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.2.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.100.0 0.0.0.255 172.16.101.0 0.0.0.255
 permit ip any any
Richard Burts Fri, 05/09/2014 - 11:39
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Yes this should be correct.

 

HTH

 

Rick

FratianiD Fri, 05/09/2014 - 13:07
User Badges:

That didn't work.
I had to change the OUT acl back to matching the source port:

permit tcp 172.16.10.0 0.0.0.255 eq domain 172.16.101.0 0.0.0.255

I'm still not getting matches on my other permit statements so I guess I just have to keep messing with it.

Richard Burts Fri, 05/09/2014 - 13:33
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

I should have read your revised ACL more carefully. I checked the change for DHCP but did not notice that you had changed checking the ports from checking source ports (as in the original ACL) to changing destination ports for all the protocols. You want to check the destination port for bootpc but for the other protocols you should be checking the source ports.

 

HTH

 

Rick

FratianiD Fri, 05/09/2014 - 14:02
User Badges:

So, my IN acl is correct, we are just working on the OUT?

 

Shouldn't I change the DHCP IN acl too?

Is this correct?

ip access-list extended VLAN101-IPv4-In
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq domain
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq www
 permit tcp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 443
 permit udp 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255 eq domain
 permit udp 172.16.101.0 0.0.0.255 eq bootps 172.16.10.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.1.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.2.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.10.0 0.0.0.255
 deny   ip 172.16.101.0 0.0.0.255 172.16.100.0 0.0.0.255
ip access-list extended VLAN101-IPv4-Out
 permit tcp 172.16.10.0 0.0.0.255 eq domain 172.16.101.0 0.0.0.255
 permit tcp 172.16.10.0 0.0.0.255 eq www 172.16.101.0 0.0.0.255
 permit tcp 172.16.10.0 0.0.0.255 eq 443 172.16.101.0 0.0.0.255
 permit udp 172.16.10.0 0.0.0.255 eq domain 172.16.101.0 0.0.0.255
 permit udp 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255 eq bootpc
 deny   ip 172.16.1.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.2.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.10.0 0.0.0.255 172.16.101.0 0.0.0.255
 deny   ip 172.16.100.0 0.0.0.255 172.16.101.0 0.0.0.255
 permit ip any any

Thank you for helping me.

Richard Burts Sat, 05/10/2014 - 15:03
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

I am afraid this is not correct. Let me try to explain it in this way:

for DNS, WWW, and HTTPS/443 the client chooses some port as the source and the server port is known. So when you write the inbound access list the known port is the destination port. So your "in" ACL should check destination port for these protocols. And for your "out" ACL these ports would be the source port.

 

DHCP is a bit different. The client sends requests to destination port bootps and the server sends responses to destination port bootpc. So your "in" ACL needs to check the destination port for bootps and your "out" ACL needs to check the destination port for bootpc.

 

HTH

 

Rick

FratianiD Sat, 05/10/2014 - 17:40
User Badges:

Ok thanks.

So just change the IN ACL back to checking bootps on the destination and I'm all set.

Richard Burts Sat, 05/10/2014 - 18:29
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

I believe so. Make the change, test, and let us know the results.

 

HTH

 

Rick

Actions

This Discussion