Cisco VLAN and ACL Change

BKGarry · September 17, 2015

Hello all,

I am being extremely slow here and need to use the edugeek wisdom. I have inherited a Cisco vlaned network from the pervious BSF service without any documentation. I am having issues with there not being enough IP addresses in the range for the BYOD VLAN.

I have got a new range for 1000 IPs for our WAN provider and have setup the DHCP scope but this is where I get stuck.

I need to change the VLAN config and ACL for it but I really cannot figure out how to do it from the Cisco website so I need some step by step instructions to allow the IP range to communicate on the ACL (as I managed to see it isn't valid at the moment) and then I need to modify the VLAN to have this new range instead of the old range.

If someone you basically do me a dummy's guide to what to enter on the consoles from login that would be excellent. As I really don't want to break something as there are at least 15 different VLANs and I don't wanna bring down everything

Thank you all in advance and sending eduhobnobs to all.

BKGarry

rrrrr · September 17, 2015

Can you post your running config highlighting vlan mentioned?

BKGarry · September 17, 2015

I will try in the morning. Is that basically "show VLAN" and whatever I did for for the ACLs like before?

rrrrr · September 17, 2015

Do show running-config. This will display the whole config including all vlans and acls. Make sure you hash out any passwords that may be stored in clear txt before sharing

FN-GM · September 17, 2015

Hi,

A show running-config would be good. Also show ip access-lists output might be handy. We will be able to see the hit counters on the rules, that will show if they are in use.

We should be able to sort you out where you would simply copy and paste some text into your switch.

Thanks

BKGarry · September 17, 2015

Thank you all.

I will run this first thing and post it. I will get putty to log it all in a text file and then paste it in.

Thank you again for your help. I must admit between this and powershell I have some training to do to catch up. 6 1/2 years writing timetables instead of being involved has made it difficult. It is nice to have everything together.

Speak to you in the morning.

BKGarry · September 18, 2015

cisco.txtHiya all,

I have had to upload it as a txt file as it was too long to post.

The new range is 10.73.52.1 to 55.255

Edited September 18, 2015 by BKGarry

rrrrr · September 18, 2015

Do you know what the old range is? So I can identify what needs to be modified

BKGarry · September 18, 2015

10.73.209.1 to 10.73.209.255

It should be labelled as BSF guest or something like that

FN-GM · September 18, 2015

Hi,

If you do the following it should work for the ACL. The change for the vlan is on next post. Please make a backup before doing this!

enter the command Conf T

paste the following in:

NO access-list 100 permit udp any any eq bootpc

NO access-list 100 permit udp any any eq bootps

NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 172.31.81.46 eq domain

NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 172.31.49.46 eq domain

NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 10.5.17.21 eq domain

NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 10.5.9.21 eq domain

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.20.0 0.0.0.255 eq www

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.12.0 0.0.0.255 eq www

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.20.0 0.0.0.255 eq 443

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.12.0 0.0.0.255 eq 443

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.20.0 0.0.0.255 eq 8080

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.12.0 0.0.0.255 eq 8080

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.73.213.0 0.0.0.127 log

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.73.212.128 0.0.0.7 eq www

NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.73.212.128 0.0.0.7 eq 443

NO access-list 100 deny ip 10.73.209.0 0.0.0.255 10.0.0.0 0.255.255.255

NO access-list 100 deny ip 10.73.209.0 0.0.0.255 192.168.0.0 0.0.255.255

NO access-list 100 deny ip 10.73.209.0 0.0.0.255 172.16.0.0 0.0.15.25

access-list 100 permit udp any any eq bootpc

access-list 100 permit udp any any eq bootps

access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.81.46 eq domain

access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.49.46 eq domain

access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.17.21 eq domain

access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.9.21 eq domain

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq www

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq www

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 443

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 443

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 8080

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 8080

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.213.0 0.0.0.127 log

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq www

access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq 443

access-list 100 deny ip 10.73.52.0 0.0.3.255 10.0.0.0 0.255.255.255

access-list 100 deny ip 10.73.52.0 0.0.3.255 192.168.0.0 0.0.255.255

access-list 100 deny ip 10.73.52.0 0.0.3.255 172.16.0.0 0.0.15.255

All we are doing here is changing the wildcard mask from 0.0.0.225 to 0.0.3.255.

Edited September 18, 2015 by FN-GM

FN-GM · September 18, 2015

To change VLAN IP

enter the following commands

Conf T

Int VLAN 40

no ip address 10.73.209.1 255.255.255.0

ip address 10.73.52.1 255.255.252.0

You will need to update the DHCP with the new ip range and subnet.

Edited September 18, 2015 by FN-GM

BKGarry · September 18, 2015

luckily that part of my DHCP server already had a 252.0 on the new scope :-) (assuming that is going for my new scope of 52.1 to 55.255)

I did get this at the end of the VLAN range commands

10.73.208.0 overlaps with Vlan600

BKGarry · September 18, 2015

Errrrr,

No longer getting DHCP though on VLAN40 :-/

BKGarry · September 18, 2015

My network hates me, I think it is the meru controller being a pain now

BKGarry · September 18, 2015

:-(

I have reversed all changes and got it back to working,

Looks like there are some settings for this on the Meru controller.

Highly annoying

Wonder if it is worth making a new VLAN and then pumping it through there later on

Edited September 18, 2015 by BKGarry

FN-GM · September 18, 2015

On your ACL, when you made the changed did you still have these lines in?

access-list 100 permit udp any any eq bootpc

access-list 100 permit udp any any eq bootps

To track if it is meru, put the setting above back on and plug in a laptop to a port assigned to VLAN 40 and see if it gets an IP.

Edited September 18, 2015 by FN-GM
typo

BKGarry · September 18, 2015

OK,

I will leave it until school has finished and try again then.

BKGarry · September 18, 2015

Dear all,

I just tried a port assigned to that VLAN and put the settings in and I can confirm this did exactly the same thing. No DHCP contact at all :-(

FN-GM · September 18, 2015

Just to confirm, do you have this in the ACL?

access-list 100 permit udp any any eq bootpc

access-list 100 permit udp any any eq bootps

BKGarry · September 18, 2015

I have had a look and cannot find it, sorry, I thought it was there.

BKGarry · September 18, 2015

actually I type in show IP access 100 and it shows nothing at all

BKGarry · September 18, 2015

OK that is not in and I am getting IP addresses :-)

- - - Updated - - -

just no internet now

- - - Updated - - -

in fact I cant ping the gateway

BKGarry · September 18, 2015

So here is my latest running config,

cisco.txt

I am probably missing something here, as I cant ping the default gateway, but I can get an IP address I also cannot ping over VLANs (probably expected)

So now it must be a question of routing the traffic somewhere

Edited September 18, 2015 by BKGarry

BKGarry · September 18, 2015

Silly question, do I need to add something to my outbound ACL?

FN-GM · September 18, 2015

Ping won't work as there is no rule to allow ICMP.

The ordering of your ACL might be stuffing this up. It matters the order of the rules. Remove all of the existing rules in list 100 only and replace it with this.