Solved: Adding Extended ACL to Port on Cisco 2960G Layer 2 Switch

Adam Handley · ‎08-17-2017

Hi,

I am trying to secure a server which is directly connected to a layer 2 switch port. I want to only permit access to the server from specific ip addresses. Example of commands entered are below.

Server = 10.10.10.1

Access-list 102 permit ip host 10.10.10.20 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.21 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.22 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.23 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.24 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.25 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.26 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.27 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.28 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.29 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.30 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.31 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.32 host 10.10.10.1

Access-list 102 permit ip host 10.10.10.33host 10.10.10.1

Access-list 102 permit tcp 10.10.11.0 0.0.0.128 host 10.10.10.1eq 3389

Access-list 102 deny ip any host 10.10.10.1

int g0/11

ip access-group 102 in

After I have entered all the above and connected the ACL to the port it blocks all access to that server so it isn't actually looking at the ACL rules. Any ideas? Is the layer 2 switch actually capable of looking at the source address as well as the destination address?

Thanks in advance.

Adam

GRANT3779 · ‎08-17-2017

When I said implicit deny I just meant the "hidden" one at the end of all ACLs, not the specific entry you added so it still would not have worked the way you wanted.

I don't think what you have scales very well but I also don't know the ins / outs or whys of what your design so lets try and work with what you have.-

I think the following would achieve what you are after - applied to Gi0/11 Inbound as you had it. Amend your ACL to below

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.20

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.21

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.22

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.23

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.24

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.25

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.26

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.27

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.28

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.29

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.30

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.31

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.32

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.33

Access-list 102 permit tcp host 10.10.10.1 eq 3389 10.10.11.0 0.0.0.128

Access-list 102 deny ip host 10.10.10.1 any

View solution in original post

GRANT3779 · ‎08-17-2017

Hi Adam,

Is your server connected to port Gi0/11?

If so you have the ACL attached to the wrong port. Applying ACL to Layer 2 Interface can only be applied Inbound, which you have done. With your ACL, remember there is an implicit deny at the end. Your server will not be able to talk to anyone. Traffic is coming from the server INTO the port and being caught by the implicit deny.

I think this is what is happening anyways.

Adam Handley · ‎08-17-2017

Thanks for replying Grant.

Yes the server is connected to G0/11 so which port should I be adding the ACL to? I have tried removing the implicit deny just in case that was causing the issues but with it being top down I tested some of the permit ACLs but all fail.

An example I have is server 10.10.10.31 wants to connect to server 10.10.10.1 on port 3389. 10.10.10.31 is actually connected to another layer 2 switch in the data centre. The server will send the request through to the layer 2 switch 10.10.10.1 is connected to and into the port that the server is connected to which is G0/11. The ACL will then be triggered and it will check that this is permitted before allowing connection.

Adam

GRANT3779 · ‎08-17-2017

When I said implicit deny I just meant the "hidden" one at the end of all ACLs, not the specific entry you added so it still would not have worked the way you wanted.

I don't think what you have scales very well but I also don't know the ins / outs or whys of what your design so lets try and work with what you have.-

I think the following would achieve what you are after - applied to Gi0/11 Inbound as you had it. Amend your ACL to below

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.20

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.21

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.22

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.23

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.24

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.25

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.26

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.27

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.28

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.29

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.30

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.31

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.32

Access-list 102 permit ip host 10.10.10.1 host 10.10.10.33

Access-list 102 permit tcp host 10.10.10.1 eq 3389 10.10.11.0 0.0.0.128

Access-list 102 deny ip host 10.10.10.1 any

Adam Handley · ‎08-17-2017

Great, thanks Grant. Swapping the hosts round has worked. The aim is to secure the server so only a number of devices can connect to it to store their backups. Simplistic design but provides what we require and I don't expect the ACL rules to expand.

Adam