ACL not behaving as expected

[Sheridan]

I'm setting up some ACLs to apply to my new VLAn schema (currently just using static routing) and I've got 2 ports on the core switch - I want to allow incoming traffic one way but not another. Simple I thought, I'll apply an ACL to the port that is going to deny the other ports traffic.

 

So the ACL Inbound on this port (simple ACL) blocks all traffic from the other port's IP range, but allows everything else (to override the implicit deny)

 

 

Now, trying to ping devices on the port where the ACL is applied seems to have unexpected results. Devices from all IP ranges can ping it, even ones on the explicity denied range. If I remove the Permit All rule then NOTHING can ping devices on that port, and they can't see anything outside their own subnet!

 

ACLs rules work top down until they match - no match means denied. But my Deny rule should block that particular IP range and allow everything else I would have thought?

[FN-GM]

Is the rule set to block IP traffic? If so that will be your issue. Ping uses ICMP not IP. I can't tell from this screenshot what its blocking.

[FN-GM]

Might be worth adding you might not be able to block the traffic one way but not the other right out of the box. Out of the box ACL's are bi-directional. To apply it one way but not the other you will need some kind of inspection, not many switches have these out of the box.

[Sheridan]

This is a Netgear switch - according to the manual a 'simple' ACL blocks all ports (UDP/IP etc) unless you specify otherwise in an advanced rule. It should just be inbound - as you have the choice to apply the ACL Inboound, Outbound or both. In my case I've applied it Inbound only as I just want to block traffic from one subnet reaching another.

[Sheridan]

TBH, I just think ACLs don't work on this model (M6100) - even using their wizard to create an ACL doesn't work as expected. Time for a rethink.

[FN-GM]

Im pretty sure those ACL's handle IP traffic only so ping will be allowed. Same in the Cisco and HP world, you have to create another ACL for that traffic. Try RDP or something with that ACL in place.

[Sheridan]

Hmm I've tried creating them as advanced rules and specified both IP and ICMP as being blocked incoming on that port, with a 'Permit all' at the end for everything else. This now blocks traffic & ping from everywhere, this is doing my head in now!

[Sheridan]

Just to update - I got this sorted (with Netgears help!). It was a mixture of misunderstanding about rule priorities and also the terminology used, even Netgear had to check their notes!