how to write ACL to allow only management Server for ACS server?

[Akbar ali Sultan]

Dear All

please guide me how can i write ACL to block all other subnets except management server or magmt vlan for ACS server?

ACS server is connected to core switch,  core switch has Vlans 192.168.3.0 - 8.0 network management Vlan is 192.168.2.0 ACS server IP is 192.168.2.17 management server IP is 192.168.2.16 

[agapitca19 · Accepted solution]

Hi,

If you want certain ip address(es) to manage ACS, you can do this in ACS by going to System Administration>Administrators>Settings>Access> select Allow only listed IP addresses to connect>Create>Put the ip address(es) that are permitted.

HTH,

***Please rate and mark the comment correct if you find it helpful. Thanks.***

[Akbar ali Sultan]

we have ACS 4.2 version i don't know this option available or not, i will update you tomorrow meanwhile if you can tell me can we block access using ACL ?

[Akbar ali Sultan]

Thank you for your great reply, its work, now can access only from management server,

but the he problem is. its showing Invalid administrator connection from another subnet is there any way to block from ACL so the traffic wont reach the interface

[agapitca19]

wow tight security policy.

1. on the switch where the the SVI/vlan interface of the other subnet that you don't want to talk to Secure ACS server, create an extended access list.

    ip access extended [acl name or number]

    deny ip 192.168.3.0 [wildcard mask] host 192.168.2.17

    permit ip any any

2.  apply the acl you created on step 1 inbound to the SVI/vlan interface of the other subnet. For example it is on SVI/vlan interface 7.

     interface vlan 7

     ip access-group [acl name or number] in

3. wr mem

4. Just repeat the same steps above for the other subnets that you don't want to communicate with Secure ACS server. 

HTH

***Please rate and mark the comment correct if you find it helpful. Thanks.***