ful56_uk Posted May 3, 2018 Posted May 3, 2018 Afternoon all struggling to get my head around this one, if i want to restrict vlan2 (guest network) from accessing the other vlans on the core switch but then only have access to certain servers on one of the vlans how would i go about doing this, this is what i think but i think i am wrong ip access-list extended ACL01 deny ip networkaddressofvlan2 0.0.0.255 networkaddressofvlan3 0.0.255.255 deny ip networkaddressofvlan2 0.0.0.255 networkaddressofvlan4 0.0.255.255 deny ip networkaddressofvlan2 0.0.0.255 networkaddressofvlan5 0.0.255.255 permit ip ipofvlan2 0.0.0.255 ipofdhcpserver 0.0.0.0 permit ip ipofvlan2 0.0.0.255 ipofdefaultgateway 0.0.0.0 vlan2 ip access-group ACL01 VLAN Thanks Mark
NetworkServices Posted May 4, 2018 Posted May 4, 2018 (edited) I think you need to put the permitted addresses above the deny. At least that's how I've always configured my ACLs. permit ip ipofvlan2 0.0.0.255 ipofdhcpserver 0.0.0.0 permit ip ipofvlan2 0.0.0.255 ipofdefaultgateway 0.0.0.0 deny ip networkaddressofvlan2 0.0.0.255 networkaddressofvlan3 0.0.255.255 deny ip networkaddressofvlan2 0.0.0.255 networkaddressofvlan4 0.0.255.255 deny ip networkaddressofvlan2 0.0.0.255 networkaddressofvlan5 0.0.255.255 permit ip 0.0.0.0 255.255.255.255. 0.0.0.0 255.255.255.255 The last permit line counters the implicit deny at the end of all ACLs. Then try applying it to the inbound interface for VLAN2. ip access-group "ACL01" in Also as a side note you might want to number each line. Eg: 10 permit ip xxxxx 20 deny tcp xxxx This allows you to easily insert additional lines if you need to without having to re-key the entire ACL each time you make a change. Edited May 4, 2018 by NetworkServices 1
Sibrows Posted May 4, 2018 Posted May 4, 2018 I'm out of the office without access to my ProCurves but I believe that you need the rules numbered and the permit rules need to precede the deny as the rules are evaluated in order and at the moment they are matching the deny rule before getting to the individual servers. 1
IrritableTech Posted May 4, 2018 Posted May 4, 2018 (edited) We have a working ACL assigned to our staff-BYOD vlan which is something like this.... ip access-list extended "BYOD" 10 permit udp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 67 20 permit udp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 68 30 permit udp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 53 40 permit tcp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 53 50 permit udp 0.0.0.0 255.255.255.255 10.15.110.17 0.0.0.0 eq 53 60 permit tcp 0.0.0.0 255.255.255.255 10.15.110.17 0.0.0.0 eq 53 70 permit tcp 0.0.0.0 255.255.255.255 10.15.110.9 0.0.0.0 eq 80 80 permit tcp 0.0.0.0 255.255.255.255 10.15.110.9 0.0.0.0 eq 443 90 deny ip 0.0.0.0 255.255.255.255 10.15.96.0 0.0.15.255 log 100 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit Then in our BYOD vlan... ip access-group "BYOD" in So we've allowed specific services rather than just open up a whole server. Lines 10 & 20 allow DHCP, 30-60 allow DNS requests to two of our servers, 70-80 access to an internal web server, 90 deny access to any other internal address (and log), finally, permit any other request (Ie. internet). Now you'll note that we do not have a line in for any routers - they are not needed. This is protecting inter vlan traffic and is processed by your switch acting as the router. So ACLs won't for example isolate your clients in the 10.15.109.1/24 subnet from each other. Edited May 4, 2018 by IrritableTech formatting 3
ful56_uk Posted May 4, 2018 Author Posted May 4, 2018 We have a working ACL assigned to our staff-BYOD vlan which is something like this.... ip access-list extended "BYOD" 10 permit udp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 67 20 permit udp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 68 30 permit udp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 53 40 permit tcp 0.0.0.0 255.255.255.255 10.15.110.16 0.0.0.0 eq 53 50 permit udp 0.0.0.0 255.255.255.255 10.15.110.17 0.0.0.0 eq 53 60 permit tcp 0.0.0.0 255.255.255.255 10.15.110.17 0.0.0.0 eq 53 70 permit tcp 0.0.0.0 255.255.255.255 10.15.110.9 0.0.0.0 eq 80 80 permit tcp 0.0.0.0 255.255.255.255 10.15.110.9 0.0.0.0 eq 443 90 deny ip 0.0.0.0 255.255.255.255 10.15.96.0 0.0.15.255 log 100 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit Then in our BYOD vlan... ip access-group "BYOD" in So we've allowed specific services rather than just open up a whole server. Lines 10 & 20 allow DHCP, 30-60 allow DNS requests to two of our servers, 70-80 access to an internal web server, 90 deny access to any other internal address (and log), finally, permit any other request (Ie. internet). Now you'll note that we do not have a line in for any routers - they are not needed. This is protecting inter vlan traffic and is processed by your switch acting as the router. So ACLs won't for example isolate your clients in the 10.15.109.1/24 subnet from each other. Thank you for this information, so have i miss understood what acl's do? so for example if i want the ip range on vlan2 not to be able to ping/rdp or whatever on the ip range on vlan 3 do i not use ACL's to do this?
NetworkServices Posted May 4, 2018 Posted May 4, 2018 Thank you for this information, so have i miss understood what acl's do? so for example if i want the ip range on vlan2 not to be able to ping/rdp or whatever on the ip range on vlan 3 do i not use ACL's to do this? ACLs control the traffic between VLANs. So for example you can prevent clients on vlan2 from accessing stuff on vlan3 and vice-versa. However they will not stop clients on vlan2 from accessing other clients on vlan2. Assuming that vlan2 is purely a BYOD then it shouldn't be an issue. Anybody who joins an open shared hotspot without effective measures like firewalls, AV etc is their problem not yours. 1
ful56_uk Posted May 4, 2018 Author Posted May 4, 2018 Ok thanks. That’s what I’m looking for to stop traffic from vlan 2 accessing vlan3. Vlan 2 only needs internet access. So along with that acl on vlan2 do I need to add one on vlan 3 as well?
NetworkServices Posted May 4, 2018 Posted May 4, 2018 You shouldn't need to as the ACL should block anything entering VLAN2 except the stuff you have permitted. I would highly recommend doing as Irritabletech suggested and only allowing protocols needed for necessary services though. DHCP, DNS etc. If you allow IP in general you are effectively opening up whatever is on the IP to all sorts of traffic such as RDP, Telnet etc. 1
ful56_uk Posted May 4, 2018 Author Posted May 4, 2018 Ok I will look at doing that. Thank you. When you say block any entering vlan2 (byod vlan) does that mean I need to create my acl on vlan3 (admin block) as I don’t want the traffic entering vlan 3? 1
NetworkServices Posted May 4, 2018 Posted May 4, 2018 You could do that although in my experience it's unnecessary (don't quote me on that) since in order for a device on vlan 2 to establish a connection with something on vlan 3 it will need two way communication. Whilst it may be able to reach out to vlan 3 it will never receive the reply. Below is a simplified example of the ACL I use on our BYOD. 10 deny tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 23 <=====Prevents any client on this subnet from using Telnet. 11 deny tcp 0.0.0.0 255.255.255.255 0.0.0.0 eq 80 <=====Prevents any client on this subnet from using http to gain access to the core switch configuration page. 15 permit udp 0.0.0.0 0.0.0.0 255.255.255.255 eq 67 <=====Allows DHCP traffic 16 permit udp 0.0.0.0 0.0.0.0 255.255.255.255 eq 68 <=====Allows DHCP traffic 17 permit udp 0.0.7.255 0.0.0.0 eq 53 <=====Allows DNS traffic 110 deny ip 0.0.7.255 0.0.1.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 2 120 deny ip 0.0.7.255 0.0.1.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 3 130 deny ip 0.0.7.255 0.0.1.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 4 140 deny ip 0.0.7.255 0.0.1.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 5 150 deny ip 0.0.7.255 0.0.1.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 6 160 deny ip 0.0.7.255 0.0.0.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 7 170 deny ip 0.0.7.255 0.0.0.255 <=====Prevents all traffic not explicitly permittted above from reaching the subnet 8 190 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 <=====Counters the explicit deny automatically appended to all ACLs by default This is then applied to the inbound BYOD VLAN. 2
ful56_uk Posted May 4, 2018 Author Posted May 4, 2018 brilliant thank you for this, when you are applying the acl to the byod vlan are you applying this as IN or VLAN 1
NetworkServices Posted May 4, 2018 Posted May 4, 2018 I apply on the inbound connection to the BYOD VLAN. So for example from the conf t menu of your core switch you'd want to enter the following command vlan 2 ip access-group "name of acl" in exit 1
ful56_uk Posted May 4, 2018 Author Posted May 4, 2018 just tested the config out on a test vlan and its doing what i want it to do now thank you.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now