Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Remote Site security !

Hi all. I have almost 100+ remote sites and management has decided to use security and remote branch end to only allow few specific IPs to access resources to/from that site. For eg Consider Site1 with LAN subnet 10.1.56.0/24, now the actual access-list entries are different but just to explain my point i am listing 3 of them here

ip access-list ex Outbound

per ip host 10.1.56.26 host 10.1.1.4

per ip host 10.1.56.8 host 10.1.2.26

per ip 10.1.56.0 0.0.0.255 host 10.1.1.8

and also its exact replica

ip access-list ex Inbound

per ip host 10.1.1.4 host 10.1.56.26

per ip host 10.1.2.26 host 10.1.56.28

per ip host 10.1.1.8 10.1.56.0 0.0.0.255

Now communication can be initiated from either side, i.e. either

10.1.1.4 -> 10.1.56.26

OR

10.1.56.26 -> 10.1.1.4

I thought of using reflexive list but i think it wont work here since communication is bi-directional. If i need to add an entry i have to add it on 2 list and since number of sites are large i am suspecting it will be a great overhead, but one thing is decided that this security must be applied on SITE end and not HUB end. So now is there any way that if i create and entry with permit statement its exact replica is also created ? i hope you are getting the idea, i dont want to create 2 seperate access-list, just one that can also allows an entry's replica as well.

Pls guide me in this

1 REPLY
Hall of Fame Super Silver

Re: Remote Site security !

Hello Ovais,

CBAC context Based Access Lists could be of help or also reflexive ACLs.

CBAC can work well but it requires firewall feature set and its modern equivalent advipservices and above.

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7c5.html

However, this kind of solution is difficult to manage even if you achieve what you are looking for, it is clear management is not realizing the overhead of this solution.

Also with standard ACLs blocking or permitting one side of communication should be enough.

Sincerly, the best would be to review this decision but I understand that it is difficult.

Hope to help

Giuseppe

217
Views
0
Helpful
1
Replies
CreatePlease login to create content