Cisco – ACL not working HELP!

aclciscoroutingswitch

I want to block the traffic from the vlans 21 and 22 on the vlan 23 without blocking 24 and 29 with an extended access list but nothing happens. I'd like to know what's wrong in my config.

Here's the acl:

Extended IP access list VISITEURS

10 permit ip any 192.168.23.0 0.0.0.255
20 permit ip any 192.168.24.0 0.0.0.255
30 permit ip any 192.168.29.0 0.0.0.255
40 permit icmp any 192.168.23.0 0.0.0.255
50 permit icmp any 192.168.24.0 0.0.0.255
60 permit icmp any 192.168.29.0 0.0.0.255
70 deny ip any 192.168.21.0 0.0.0.255
80 deny ip any 192.168.22.0 0.0.0.255
90 deny icmp any 192.168.22.0 0.0.0.255
100 deny icmp any 192.168.21.0 0.0.0.255
110 permit ip any any

The acl is applied as inbound on the vlan 23

Thanks

Best Answer

If you are applying the extended ACL inbound from VLAN 23, then you are trying to block traffic from VLAN 23 to the router. It also makes no sense to include VLAN 23 addressing in the ACL because the VLAN 23 traffic is delivered directly from host to host on the VLAN, and it doesn't pass through the router.

If you want to block traffic from other VLANs to VLAN 23, then you need an outbound ACL on VLAN 23. The in and out keywords are from the perspective of the router, not the VLAN.

In general, you should apply standard ACLs outbound, as close to the destination as possible, and you apply extended ACLs inbound, as close to the source as possible. In this case you could apply the extended ACL at the destination VLAN (23), but you would be unnecessarily routing the traffic from the other VLANs to the VLAN 23 interface. It will work, but it wastes router resources.

Something like:

ip access-list extended BLOCK_21_22
 deny ip 192.168.21.0 0.0.0.255 any
 deny ip 192.168.22.0 0.0.0.255 any
 permit ip any any
!
interface Vlan23
 ip access-group BLOCK_21_22 out
!

A better solution is to place the ACL inbound on VLANs 21 and 22 to block traffic to VLAN 23. This will prevent traffic from those VLANs destined to VLAN 23 from being routed at all:

ip access-list extended BLOCK_23
 deny ip any 192.168.23.0 0.0.0.255
 permit ip any any
!
interface Vlan21
 ip access group BLOCK_23 in
!
interface Vlan22
 ip access group BLOCK_23 in
!

Related Solutions

HP Procurve 5406zl – ACL issue

According to the Access Security Guide for your device, the first address and mask of an ACE is source and the second address and mask is the destination. (Just in case, an ACE is an Access Control Entry; that is any line an access-list is made of)

ACE 20 of your ACL states source 192.168.50.0/24 and destination 192.168.101.0/24, then you apply the ACL at VLAN 101 input; however, your VLAN 101 is 192.168.101.0/24, so any input traffic at VLAN 101 would have source address in 192.168.101.0/24. So ACE 20 in your ACL is wrong, you need an ACE with action permit, source 192.168.101.0/24 and destination 192.168.50.0/24.

ip access-list extended "SecureContent"
    10 permit ip 192.168.101.0 0.0.0.255 192.168.50.0 0.0.0.255

Regarding the way back for this traffic, it will cross VLAN 101 outbound, so ACL should not be applied to this traffic and it should be allowed.

If traffic back is not allowed then you need to add the way back in your ACL.

ip access-list extended "SecureContent"
    10 permit ip 192.168.101.0 0.0.0.255 192.168.50.0 0.0.0.255
    20 permit ip 192.168.50.0 0.0.0.255 192.168.101.0 0.0.0.255

EDITED to change the line above to reflect proper ACL structure of numbered entries. (10, 20, etc).

Cisco IOS – Simple Egress Block ACL Configuration

With Cisco ACL's, there is an implicit deny ip any any at the end of every list. You need to explicitly state the traffic that you want to allow/deny. Note that it short-circuits on the first ACL entry it hits that it applies to, so if you're sending a packet from a host on the 208.73.210.0/23 network, it will first hit this ACL entry:

permit tcp any any

If it is TCP, it will be allowed regardless of its source. This is a rather moot entry since the next one will allow any source IP address over any protocol. Change it to:

ip access-list extended wan_ipv4_out
  deny tcp any 208.73.210.0 0.0.1.255
  permit ip any any

Note that the 208.73.210.0/23 network will still be able to communicate to other networks over different protocols (UDP, ICMP, etc). To block all outgoing traffic, try:

ip access-list extended wan_ipv4_out
  deny ip any 208.73.210.0 0.0.1.255
  permit ip any any

This will allow all traffic except incoming traffic on FastEthernet8 with a source address of 208.73.210.0/23.

Best Answer

Related Solutions

HP Procurve 5406zl – ACL issue

Cisco IOS – Simple Egress Block ACL Configuration

Related Topic