ACL on Trunk Port – Security Configuration

aclSecuritytrunk

our network infrastructure as showing the image below

enter image description here

I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26.35.28) which are existed in our LAN 172.26.x.x/16 as showing.

their access has to be only permitted on these 2 machines and to the internet.
-gateway IP (Cisco ASA internal):10.10.10.6
-DNS 1 IP: 172.26.33.2
-DNS 2 IP: 172.26.33.4

I have configured an ACL to allow their access only to (IP Camera,Server,Internet)and applied the ACL on the trunk port Fa0/19 connecting between access switch 1 & access Switch 2 as per below knowing that STA6-2 is Access Switch 1 in the diagram:

enter image description here

enter image description here

enter image description here
……………………………..
the problem is that after applying the ACL , server still have access to other resources on the LAN (example My PC 172.26.39.147)

enter image description here

so please enlighten me on how to fix this.

Regards,
Ethem

Best Answer

Your mistake is that the trunk interface is a layer-2 interface, but you are trying to apply a layer-3 ACL. Layer-2 switching doesn't look at the layer-3 addressing, which is what your ACL is using. You need to apply the ACL to a layer-3 (SVI) interface.

The point of VLANs is that traffic cannot get from one VLAN to another VLAN, except through a router (or routing module in a layer-3 switch). A trunk keeps traffic in each VLAN separate, just as if you had separate physical switches, by tagging the frames with VLAN tags.

Routing will, by default, route traffic from one VLAN to another, but you can place ACLs in the routed interfaces (those with IP addresses assigned to them) to allow or block specific traffic.

You are using extended ACLs, so you should place them as close to the traffic source as possible.

Related Topic