Guest Guest Posted July 24, 2020 Posted July 24, 2020 (edited) We've just installed an L3 switch and I have VLANs etc working as we require. However, I'm having issues getting the ACLs to work correctly. I added the below rules and after this all Internet access was blocked from the source subnet, I'd appreciate some pointers on this, the switch we've installed is a Dell N2024 10 deny udp 10.255.1.0 0.0.0.255 10.129.128.0 0.0.3.255 log 15 deny tcp 10.255.1.0 0.0.0.255 10.129.128.0 0.0.3.255 log 20 deny icmp 10.255.1.0 0.0.0.255 10.129.128.0 0.0.3.255 log 25 deny udp 10.255.1.0 0.0.0.255 10.255.2.0 0.0.0.255 log 30 deny tcp 10.255.1.0 0.0.0.255 10.255.2.0 0.0.0.255 log 35 deny icmp 10.255.1.0 0.0.0.255 10.255.2.0 0.0.0.255 log Any help is greatly appreciated Edited July 24, 2020 by Guest
chris11256 Posted July 24, 2020 Posted July 24, 2020 (edited) ACL's have an implicit deny at the end. So any traffic that isn't permitted within the ACL will be denied at the end. You'll need to add lines that permit the traffic you want permitted, where possible optimise the ACL so that those rules likely to be met first are at the top of the ACL. Edited July 24, 2020 by chris11256
Steve21 Posted July 24, 2020 Posted July 24, 2020 Also depends what your clients IP etc are considering you're blocking a lot of UDP/TCP ports etc What's an example client IP that's blocked? And then what's the destinations that's blocked, e.g. servers etc? switches? firewall? Steve
Guest Guest Posted July 24, 2020 Posted July 24, 2020 Also depends what your clients IP etc are considering you're blocking a lot of UDP/TCP ports etc What's an example client IP that's blocked? And then what's the destinations that's blocked, e.g. servers etc? switches? firewall? Steve A client would be 10.255.1.10 and a destination would be 10.129.128.60. This is our guest VLAN so needs to be totally isolated from the rest of the network
Steve21 Posted July 24, 2020 Posted July 24, 2020 And I assume "currently" your router/firewall, DNS/DHCP server etc isn't included in the "non-guest" side you've blocked? Or if it is you've setup a route for the clients to get to the internet/dns etc? Steve
Guest Guest Posted July 24, 2020 Posted July 24, 2020 Our Internet is provided via a point to point link from our providers router so the switch is our "router". Prior to this we just a flat network and so can add rules to allow access to DNS
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now