Cisco ACL Help

[FN-GM]

Hello,

 

Please see the attached diagram. The people who own our building have a few VLAN's on our switches. The vlans in the circles belong to them. I have setup some ACL's so that any devices in these VLAN's can communicate with each other. EG a device in VLAN 120 can communicate with a device in VLAN 121 but they cannot communicate with devices outside these 3 VLANS. They can't communicate with VLAN 110, devices in VLAN 110 cannot communicated with the circled VLANs. Basically separating the left (of the switch) and the right from talking with each other. These ACL's work a treat.

 

I would like it so any device in VLAN 110 can go to port 80 to 172.32.3.2 (VLAN 123). But the IP Access list called BMS-WEB to allow this doesn't seem work, but it is showing matches on the rule.

 

Below are my rules

 

Extended IP access list CCTV-SEC
   10 permit ip 172.32.1.0 0.0.0.255 172.32.2.0 0.0.0.255 (12 match(es))
   20 permit ip 172.32.1.0 0.0.0.255 172.32.3.0 0.0.0.255 (12 match(es))
Extended IP access list ACC-CTRL
   10 permit ip 172.32.2.0 0.0.0.255 172.32.1.0 0.0.0.255 (11 match(es))
   20 permit ip 172.32.2.0 0.0.0.255 172.32.3.0 0.0.0.255 (13 match(es))
Extended IP access list BMS-NEW
   10 permit ip 172.32.3.0 0.0.0.255 172.32.1.0 0.0.0.255 (8 match(es))
   20 permit ip 172.32.3.0 0.0.0.255 172.32.2.0 0.0.0.255 (11 match(es))
Extended IP access list BMS-WEB
   10 permit tcp 172.16.1.0 0.0.0.255 host 172.32.3.2 eq www (36 match(es))

 

Below is my VLAN config

 

interface Vlan110
ip address 172.16.1.254 255.255.255.0
!
interface Vlan120
description CCTV Security
ip address 172.32.1.254 255.255.255.0
ip access-group CCTV-SEC in
!
interface Vlan121
description Access CRTL
ip address 172.32.2.254 255.255.255.0
ip access-group ACC-CTRL in
!
interface Vlan123
description BMS
ip address 172.32.3.254 255.255.255.0
ip access-group BMS-NEW in
ip access-group BMS-WEB out

 

Any ideas please?

 

Thanks

[twin--turbo]

Without looking into it massivly ( I hate ACLS )

 

Cisco ACL's are not stateful so you have to be explicit in what can go each way.

 

I would imagine you have a one way rule to allow traffic to the web server but the traffic going back is being blocked.

 

 

Just a thought.....

 

Rob

[FN-GM]

You was right i didn't have the return, someone on a Cisco forum helped as well.

 

thanks very much.

[twin--turbo]

post up the fix then otherwise some poor .... will find the thread in 3 years and curse that the solution was ommitted

 

Rob

[FN-GM]

Will do once i have fully tested Dont like giving duff info