Re: A5800 and ACLs (1160 Views)
Reply
Regular Advisor
L1nklight
Posts: 139
Registered: ‎01-30-2012
Message 1 of 4 (1,184 Views)

A5800 and ACLs

I am relatively new to ACLs on this switch module and I was hoping someone could help me understand what I have to do to apply an ACL to a pair of VLANs.

 

Currently I have a internally designated VLAN and a dmz designated VLAN and traffic is permitted to pass between them. I would like to stop this behavior with the exception of a few ports/protocols, but for now a simple block all will be sufficient. 

 

My internally desginated vlan is 192.168.1.0 and my dmz desginated VLAN is 192.168.2.0. Both are 24 bit subnets. 

 

I've created the following acl:

 

acl number 3000
 rule 0 deny ip source 192.168.1.0 0 destination 192.168.2.0 0

 

Now, according to some of the documentation I've read I have to do something with traffic classifier? Is this correct? Any info on what my next step should be would be awesome. Thanks in advance. 

Please use plain text.
Regular Advisor
L1nklight
Posts: 139
Registered: ‎01-30-2012
Message 2 of 4 (1,182 Views)

Re: A5800 and ACLs

Ok so I setup some tests and I got working what I need to work. This was accomplished by the following procedure:

 

acl number 3000
 rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
#
interface GigabitEthernet1/0/1
 packet-filter 3000 inbound
 packet filter 3000 outbound

 Now I want to make some rules for specific hosts with specific tcp ports. Is there a way to combine tcp ports into one? For example if I want to allow 80 and 443 to host 192.168.2.5, what would the rule look like?

acl number 3000
 rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
 rule 1 permit tcp source 192.168.2.4 0.0.0.0 destination 192.168.2.5 0.0.0.0 destination-port eq 80,443

 

Please use plain text.
Occasional Advisor
GrahamB154
Posts: 10
Registered: ‎03-14-2012
Message 3 of 4 (1,171 Views)

Re: A5800 and ACLs

I'm not sure about combining multiple ports into one statement, remember you can simply add a separate rule with the new destination port below the first.

 

In your example however, I believe this won't work because the ACL is applied based on rule number. So it will apply rule 0 first - Denying everything, and dropping the traffic. You need the most specific statements at the top of the ACL and the 'catch all' ones at the bottom. The explicit deny should usually be at the bottom of the ACL rules set.

 

Make rule 0 equal to rule 20, and specify the others to start with rule 5.. 10 etc. If you leave spaces then it makes it easier to modify the ACL later on.

 

Cheers,

 

Graham

Please use plain text.
Respected Contributor
Michael A. McKenney
Posts: 818
Registered: ‎06-08-2009
Message 4 of 4 (1,160 Views)

Re: A5800 and ACLs

ACLs are usually one to one.   Usually you do your deny rules first and then the last rule is a implicit permit to allow any traffic not covered under deny rules as allowed.   I would not try to combine port rules together in one rule.  I would have separate rules for each so you can analyze traffic problems easier. 

 

 

 

 

Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation