Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Problem with ACL 3560G not block all traffic

Hi!

I have SVI in my 3560G

!

interface Vlan304

ip address x.x.x.x 255.255.255.248 secondary

ip address y.y.y.y 255.255.255.248 secondary

ip address s.s.s.s 255.255.255.248 secondary

ip address z.z.z.z 255.255.255.248

ip access-group Vlan304-in in

and I block network s.s.s.s/29

sh ip access-lists Vlan304-in

Extended IP access list Vlan304-in

deny ip s.s.s.s 0.0.0.7 any

permit ip any any

I have seen in statistics (netflow) the proceeding traffic from this subnet. I have found out that it is inquiries udp on the destination port 5150.

I have changed access-list Vlan304-in:

sh ip access-lists Vlan304-in

Extended IP access list Vlan304-in

deny tcp s.s.s.s 0.0.0.7 gt 0 any gt 0

deny udp s.s.s.s 0.0.0.7 gt 0 any gt 0

permit ip any any

and traffic is stop from this subnet.

Why in the first case the access-list did not block all traffic?

1 REPLY
Bronze

Re: Problem with ACL 3560G not block all traffic

To my knlowledge the first ACL must work, because the first ACL statement will block all IP traffic for the segment. The problem might be the duplicate statment if you applied the first case and second case at a time. Because the access list will take the exact match.

106
Views
0
Helpful
1
Replies