+ Post New Thread
Results 1 to 5 of 5
Wired Networks Thread, Cisco ACL Help in Technical; Hello, Please see the attached diagram. The people who own our building have a few VLAN's on our switches. The ...
  1. #1

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,942
    Thank Post
    886
    Thanked 1,694 Times in 1,472 Posts
    Blog Entries
    12
    Rep Power
    447

    Cisco ACL Help

    Hello,

    Please see the attached diagram. The people who own our building have a few VLAN's on our switches. The vlans in the circles belong to them. I have setup some ACL's so that any devices in these VLAN's can communicate with each other. EG a device in VLAN 120 can communicate with a device in VLAN 121 but they cannot communicate with devices outside these 3 VLANS. They can't communicate with VLAN 110, devices in VLAN 110 cannot communicated with the circled VLANs. Basically separating the left (of the switch) and the right from talking with each other. These ACL's work a treat.

    I would like it so any device in VLAN 110 can go to port 80 to 172.32.3.2 (VLAN 123). But the IP Access list called BMS-WEB to allow this doesn't seem work, but it is showing matches on the rule.

    Below are my rules

    Code:
    Extended IP access list CCTV-SEC
        10 permit ip 172.32.1.0 0.0.0.255 172.32.2.0 0.0.0.255 (12 match(es))
        20 permit ip 172.32.1.0 0.0.0.255 172.32.3.0 0.0.0.255 (12 match(es))
    Extended IP access list ACC-CTRL
        10 permit ip 172.32.2.0 0.0.0.255 172.32.1.0 0.0.0.255 (11 match(es))
        20 permit ip 172.32.2.0 0.0.0.255 172.32.3.0 0.0.0.255 (13 match(es))
    Extended IP access list BMS-NEW
        10 permit ip 172.32.3.0 0.0.0.255 172.32.1.0 0.0.0.255 (8 match(es))
        20 permit ip 172.32.3.0 0.0.0.255 172.32.2.0 0.0.0.255 (11 match(es))
    Extended IP access list BMS-WEB
        10 permit tcp 172.16.1.0 0.0.0.255 host 172.32.3.2 eq www (36 match(es))
    Below is my VLAN config

    Code:
    interface Vlan110
     ip address 172.16.1.254 255.255.255.0
    !
    interface Vlan120
     description CCTV Security
     ip address 172.32.1.254 255.255.255.0
     ip access-group CCTV-SEC in
    !
    interface Vlan121
     description Access CRTL
     ip address 172.32.2.254 255.255.255.0
     ip access-group ACC-CTRL in
    !
    interface Vlan123
     description BMS
     ip address 172.32.3.254 255.255.255.0
     ip access-group BMS-NEW in
     ip access-group BMS-WEB out
    Any ideas please?

    Thanks
    Attached Images Attached Images

  2. #2

    twin--turbo's Avatar
    Join Date
    Jun 2012
    Location
    Carlisle
    Posts
    2,334
    Thank Post
    1
    Thanked 381 Times in 340 Posts
    Rep Power
    150
    Without looking into it massivly ( I hate ACLS )

    Cisco ACL's are not stateful so you have to be explicit in what can go each way.

    I would imagine you have a one way rule to allow traffic to the web server but the traffic going back is being blocked.


    Just a thought.....

    Rob

  3. #3

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,942
    Thank Post
    886
    Thanked 1,694 Times in 1,472 Posts
    Blog Entries
    12
    Rep Power
    447
    You was right i didn't have the return, someone on a Cisco forum helped as well.

    thanks very much.

  4. #4

    twin--turbo's Avatar
    Join Date
    Jun 2012
    Location
    Carlisle
    Posts
    2,334
    Thank Post
    1
    Thanked 381 Times in 340 Posts
    Rep Power
    150
    post up the fix then otherwise some poor .... will find the thread in 3 years and curse that the solution was ommitted

    Rob

  5. #5

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,942
    Thank Post
    886
    Thanked 1,694 Times in 1,472 Posts
    Blog Entries
    12
    Rep Power
    447
    Will do once i have fully tested Dont like giving duff info

SHARE:
+ Post New Thread

Similar Threads

  1. Why wont my Cisco ACL work?
    By FN-GM in forum Wired Networks
    Replies: 5
    Last Post: 3rd December 2012, 08:02 PM
  2. Cisco ACL Generator
    By FN-GM in forum How do you do....it?
    Replies: 5
    Last Post: 30th November 2012, 11:28 AM
  3. UltraVNC Skeep ACL help
    By wmb555 in forum Windows 7
    Replies: 3
    Last Post: 18th May 2011, 10:46 PM
  4. Cisco CCNA Help
    By nephilim in forum How do you do....it?
    Replies: 11
    Last Post: 16th June 2010, 09:57 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •