Why wont my Cisco ACL work?

[FN-GM]

Hi,

 

The below is a snippet of my Cisco 3560 config. I am setting up a ACL for VLAN 600. It it setup the deny all unless there is a permit rule.

 

The blue text is a rule for DHCP and works a treat (woo hoo)

The red text is to allow port 80 (web) on the same server, but this rule doesn't work - If i remove the ACL from the VLAN i can get to it fine.

 

The host for DHCP and web services is 172.20.1.1

 

What have i done wrong please?

 

Thanks

 

interface Vlan600
description BYOD VLAN
ip address 10.12.12.254 255.255.255.0
ip access-group BYOD out
ip helper-address 172.20.1.1
!
ip access-list extended BYOD
[color="#0000CD"]permit udp 10.12.12.0 0.0.0.255 eq bootpc host 172.20.1.1 eq bootps[/color]
[color="#FF0000"]permit tcp 10.12.12.0 0.0.0.255 host 172.20.1.1 eq www[/color]
deny   ip any any

Edited December 3, 2012 by FN-GM

[DMcCoy]

It's possible neither rule is actually working, the dhcp request is probably being relayed via the helper address.

[FN-GM]

If i remove the rule and leave the ip helper it wont pickup an IP, based on that i am assuming it is working.

[DMcCoy]

It's difficult to tell without seeing the whole config. I assume the clients are using 10.12.12.254 as their gateway, and the web server is using 172.20.1.254. If the web server has external address then you may need to put a route on it for the 10.12.12.0 range.

[twin--turbo]

swap to

 

ip access-group byod in.

 

and I just use

 

permit udp any eq bootpc any

 

for dhcp with the helper in the vlan too

 

 

you should not need the deny either as this should be explicit.

 

Rob

[twin--turbo]

interface Vlan600

description BYOD VLAN

ip address 10.12.12.254 255.255.255.0

ip access-group BYOD in

ip helper-address 172.20.1.1

!

ip access-list extended BYOD

permit udp any any eq bootpc

permit tcp 10.12.12.0 0.0.0.255 host 172.20.1.1 eq www