abillybob Posted March 26, 2019 Posted March 26, 2019 Hi All Just wondering if you can think of a fun filled way in order to allow devices from a workstation VLAN to communicate to the CCTV VLAN but not allow the CCTV cameras to access any IP's on any other VLAN but the one they're on? Kind of hard to describe so sorry if I did a crappy job
glen_j Posted March 26, 2019 Posted March 26, 2019 what switch are you using to route the vlans, should be fairly straight forward with an ACL. or you can remove the gateway from the camera ip address settings.
Norphy Posted March 26, 2019 Posted March 26, 2019 An ACL is probably the easiest way of going about it. What brand of switch are you using?
abillybob Posted March 26, 2019 Author Posted March 26, 2019 what switch are you using to route the vlans, should be fairly straight forward with an ACL. or you can remove the gateway from the camera ip address settings. Using a Layer 3 Cisco switch, can't remember the exact model. How would I go about setting up an ACL on a Cisco switch? I've tried removing the gateway but to no avail.. I know it sounds weird but the server which is on a different VLAN can still see the cameras so I would presume it would mean taking the gateway out of the server which I can't do
Norphy Posted March 26, 2019 Posted March 26, 2019 If it were an HP or 3com switch I’d be able to help you. Paging @FN-GM, this is your area I think!
FN-GM Posted March 26, 2019 Posted March 26, 2019 An ACL is probably the easiest way of going about it. What brand of switch are you using? Using a Layer 3 Cisco switch, can't remember the exact model. How would I go about setting up an ACL on a Cisco switch? I've tried removing the gateway but to no avail.. I know it sounds weird but the server which is on a different VLAN can still see the cameras so I would presume it would mean taking the gateway out of the server which I can't do The best way to describe what you want in the real world is a "cat flap". You want allow the cat to go from inside to outside without restriction. But you don't want the cats coming from the outside indoors. In your network the outdoor is the CCTV VLAN and Indoors is your workstation VLAN. A "normal" ACL is bi-directional. So if you block traffic going from your CCTV VLAN into your Workstation VLAN it won't be able to come back. Not what you want. There is something called a Context-based access control list (CBAC) however only the newer high end Cisco L3 switches support it - reason being is CBACs run in the software of the device. These cost a lot of money so I would bet my car your switch won't support these. Because they run in the software You can use a Cisco router instead of an L3 switch for CBAC. The older version of CABC is Reflexive ACL. A standard ACL is best used for things like a guest WIFI network. You want to allow routing for the internet but don't want it to communicate with your workstations and vice versa. Back to the original question - you might be best of using a proper firewall for this. Depending on the budget you could use something like PFsense? 1
glen_j Posted March 27, 2019 Posted March 27, 2019 (edited) A layer 3 cisco switch should allow this without issue. If you create an extended ACL allowing cctv vlan to access specific IP's on the vlan you want assuming you have a few PC's that need to access for review don't forget to add exceptions for DHCP, DNS, Time servers ect. If you put nothing else in the ACL it will by default block access to any other IP address. Have a look here https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-3s/sec-data-acl-xe-3s-book/sec-create-ip-apply.html in your case you would create an ACL and place it on the cctv vlan interface inbound. Edited March 27, 2019 by glen_j
FN-GM Posted March 27, 2019 Posted March 27, 2019 (edited) A layer 3 cisco switch should allow this without issue. If you create an ACL allowing cctv vlan to access specific IP's on the vlan you want assuming you have a few PC's that need to access for review don't forget to add exceptions for DHCP, DNS, Time servers ect. If you put nothing else in the ACL it will by default block access to any other IP address. Have a look here https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-3s/sec-data-acl-xe-3s-book/sec-create-ip-apply.html in your case you would create an ACL and place it on the cctv vlan interface inbound. This does not cater for the original request. "not allow the CCTV cameras to access any IP's on any other VLAN" With your suggestion those CCTV cameras will be able to access devices on the workstation VLAN. Edited March 27, 2019 by FN-GM
glen_j Posted March 27, 2019 Posted March 27, 2019 This does not cater for the original request. "not allow the CCTV cameras to access any IP's on any other VLAN" With your suggestion those CCTV cameras will be able to access devices on the workstation VLAN. I read it as he needed to access CCTV from some PC's on workstation vlan but not allow access to other VLANs.
abillybob Posted March 27, 2019 Author Posted March 27, 2019 Thank you all for your help Yes basically I don't want the CCTV cameras to be able to access any other VLAN other than their own but I still want it so that other devices on other VLANs can still access the CCTV cameras if needs be. @FN-GM Oh damn, so I'm pretty stuck then? Our Core Switch is quite old around 5 years old it's a WS-C3650X-24.
glen_j Posted March 27, 2019 Posted March 27, 2019 Thank you all for your help Yes basically I don't want the CCTV cameras to be able to access any other VLAN other than their own but I still want it so that other devices on other VLANs can still access the CCTV cameras if needs be. @FN-GM Oh damn, so I'm pretty stuck then? Our Core Switch is quite old around 5 years old it's a WS-C3650X-24. In that case the ACL I suggested would work fine. You just need to add the IP of each machine that you want to talk to the cctv cameras, you can add more IP's to be allowed as you need to. Anything not on the list wouldn't be able to communicate with the cameras. you should be able to do ACLs on the switch.
FN-GM Posted March 27, 2019 Posted March 27, 2019 (edited) In that case the ACL I suggested would work fine. You just need to add the IP of each machine that you want to talk to the cctv cameras, you can add more IP's to be allowed as you need to. Anything not on the list wouldn't be able to communicate with the cameras. you should be able to do ACLs on the switch. He doesn't want the physical cameras communicating with any other VLAN. IE: traffic initiated from the CCTV camera to his workstations. Your suggestion will not facilitate this. Edited March 27, 2019 by FN-GM
ITGuyWestMidlands Posted March 28, 2019 Posted March 28, 2019 Trouble with CCTV is that the traffic is normally lt udp. If it were tcp, you could use permit tcp any any established to only allow traffic that is in response to an established tcp connection from another VLAN. Obviously you can restrict the destination VLAN to just your work station vlan as needed.
glen_j Posted March 28, 2019 Posted March 28, 2019 He doesn't want the physical cameras communicating with any other VLAN. IE: traffic initiated from the CCTV camera to his workstations. Your suggestion will not facilitate this. I'm curious as to why it wouldn't work, would you mind explaining why? In post 10 he states that he does want some devices on other VLANs to communicate with cameras.
FN-GM Posted March 28, 2019 Posted March 28, 2019 I'm curious as to why it wouldn't work, would you mind explaining why? In post 10 he states that he does want some devices on other VLANs to communicate with cameras. That is correct. But he doesn't want devices from the CCTV VLAN to communicate with the workstations. From what I have understood he wants to allow traffic from the workstation VLAN to the CCTV but not allow traffic originating from the CCTV back to the workstations. Very similar to a DMZ. Putting in an out of the box ACL can restrict traffic yes. But they are not intelligent enough to know where it originated from. So when you allow the traffic in the ACL it will allow it in both directions. This isn't what the OP wants because he wants to block traffic originating from the CCTV VLAN. 1
abillybob Posted March 28, 2019 Author Posted March 28, 2019 Would there be anyway to deny access to all cameras except for specific IP's? So could I say for example my computer which is on 172.16.128.1 and the NVR's which are on 172.16.136.200, 201, 202 can access all the IP addresses on that VLAN but any other IP can't access the cameras?
abillybob Posted March 28, 2019 Author Posted March 28, 2019 Maybe this will work as these are the only 4 IP's I need to have access to this VLAN. Not sure on commands or anything on how to make this work would you know @FN-GM?
glen_j Posted March 28, 2019 Posted March 28, 2019 (edited) Bit rusty but this should be correct anyone feel free to correct this. you will need to add dhcp / dns servers to the list if required conf t ip access-list extended 101 permit ip any host 172.16.128.1 permit ip any host 172.16.136.200 permit ip any host 172.16.136.201 permit ip any host 172.16.136.202 then go to the cctv vlan interface and type ip access-group 101 in Edited March 28, 2019 by glen_j 1
abillybob Posted March 28, 2019 Author Posted March 28, 2019 Thanks @glen_j the three server 172.16.136.200, 201 and 202 are on the same VLAN as the CCTV cameras so would these need to be added or will these be ok as they're on the same VLAN? Ah yes thank you didn't think of the DNS and DHCP server!
glen_j Posted March 29, 2019 Posted March 29, 2019 No they wouldn't need to be added if they are on the same VLAN as the cameras.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now