Cisco WAN :: 2960 / Block Traffic Under Two VLANs - Unidirectional Or Bidirectional
Aug 22, 2012
I have a Ciso L3 switch with 4 VLANs and all host computer connected to rest of 8 cisco 2960 switch's:
VLAN 1 : 192.168.1.0/24
VLAN 10: 192.168.10.0/24
VLAN 20: 192.168.20.0/24
VLAN 50: 192.168.30.0/24
There are list of my some Questions about Extended ACL serialwise :
1. For Restrict traffic from VLAN 10 to VLAN 20, I am using only one ACL is : Access-list 100 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255.\ What will happen in this scenerio if we talk about traffic from VLAN 20 to VLAN 10. Will it communicate or not ???
2. How to Block the traffic from VLAN 10 to VLAN 20 but allow the traffic from VLAN 20 to VLAN 10 ?
View 16 Replies
ADVERTISEMENT
Apr 16, 2013
Is there a way to block lan to lan traffic (except lan to gateway/gateway to lan traffic of course) on a Cisco 2960?
View 9 Replies
View Related
Aug 3, 2012
I have a Cisco C3560CG which is running C3560c405ex-UNIVERSALK9-M), Version 12.2(55)EX2.The switch has vlan 1 and vlan 50 configured, vlan 50 should have access to a limited number of host in vlan 1.The following acl has been applied on the inbound to vlan 50:
10 permit tcp 10.16.30.0 0.0.0.255 host 192.168.15.243 eq 137 138 139 445
20 permit udp 10.16.30.0 0.0.0.255 host 192.168.15.243 eq netbios-ns netbios-dgm netbios-ss 445
25 permit icmp 10.16.30.0 0.0.0.255 host 192.168.1.243
26 permit ip 10.16.30.0 0.0.0.255 host 10.16.30.254
30 permit ip 10.16.30.0 0.0.0.255 host 192.168.15.254
[code]....
I sure the above would work, but for some reason some of the packet counter are not incrementing but the traffic is being blocked. But I would like to see the counter increment.Also I have that I may beed to use VACL wouls this be the case?
View 26 Replies
View Related
Apr 18, 2013
I have a an ASA 5520 connected to a Layer 3 (3750) switch (Inside) and a connection to a 2960 switch (Outside) to get to the internet. . I have created vlan interfaces on the 3750 switch and enabled ip routing on the switch to enable the vlans to communicate with each other.
Vlan Interfaces on the switch:
Vlan 100 172.17.1
Vlan 200 172.18.1
Vlan 300 192.168.3.1
I want the devices connected to the 3 vlans to be able to pass through the firewall and get out to the internet.I have connected the ASA to the 3750 by routed interfaces (10.10.10.1) --------- (10.10.10.2) and they are able to ping each other.I have also put a default route on the 3750 sending all traffic from the switch to the ASA inside interface (10.10.10.1)The issue that i am having is that the ASA also connects to a 2960 which has a connection to the Internet, and they are handing off an ethernet connection from the 2960 that sits in VLAN 55 (Vlan 55 is the Internet accessible vlan).How do I configure my ASA to send all traffic from my (3) vlans to the interfaces that connects to the 2960 switch?
View 21 Replies
View Related
Apr 29, 2012
I have an ASA 5520 with the below config
Gi0/0: outside (Internet)
Gi0/1: inside (Internal users)
Gi0/2: DMZ (web servers, ftp, Mail etc..)
I have a SMTP relay deployed on the DMZ for mailing. I have also a mail servers installed in the internal lan,
I want to allow trafic from dmz to reach internal lan, and i want normally also allow stmp relay from dmz to reach Internet.
How can i block trafic from DMZ to reach Internal Lan (instead of smtp) if the to allow trafic from dmz to internet i must put ANY in the policy?
For allowing trafic from DMZ to reach Internet, the policy must be DMZ -----> ANY ----->Services., this policy means DMZ can implicity reach Internal Lan?
View 2 Replies
View Related
Oct 30, 2011
My ISP insists on using a /30 IP WAN block to connect to its equipment even though it is an ethernet handoff. They wil then route a /27 public IP block to my firewall. I would have liked to skip the WAN block and connect my PIX directly to the interface but now have to deal with two sets of IP blocks and routing between them but I still want to avoid having to use a router in between their equipment and my firewall.Is it possible to use one of the switch ports on the PIX and configure it as a separate VLAN to handle the WAN block and then route internally to another VLAN with the public block and still be able to use NAT, ACL and IPSec on the PIX?
View 4 Replies
View Related
Jan 10, 2012
I have two 3560x Catalyst switches setup between two different locations. They link via a PTP line (Layer 2). I have setup Intervlan routing between the switches and that works fine.Each location has a separate subnet and a Windows DHCP server for each subnet.I want to block any DHCP requests to be sent from hosts on one subnet to the DHCP server on the other side (i.e across the PTP link) What is the best method to do this?
View 5 Replies
View Related
May 22, 2012
I have a LAN with 6 vlans and a 2821 router. By default, intervlan routing is enabled for all vlans, however, I want specific vlans to be denied access to others, though all should still be able to use the Internet being served from GE/0.
View 6 Replies
View Related
Feb 23, 2012
We recently updated a site2site link to metro ethernet, ISP call it 100mbps LAN Extension, but to me it is just QinQ over fibre connection. Most went well, one thing (annoying to me) is we can not ping our switches on both ends anymore.
We have a 3750 in headend and another 2960 on the other end. I used to be able to ping/telnet to the management IP from one to the other. Now we can not. I think the ISP is applying some configuration on ports of their customer-premises equipments (both are Cisco switches) but agent in ISP told me no. I thought there is some configuration on Cisco switch to block "MAC discovery" but i just can not remmenber what was that and google also failed me this time.
View 3 Replies
View Related
Aug 7, 2011
I have a device that does ip audio on one mac address and managagement is on another mac address. Both of these mac addresses come from one NIC on the device. We need to split these two traffic paths into two different vlans.How can I program this switch to sperate the different traffic into two vlan's based on mac address on one interface?
View 2 Replies
View Related
Aug 2, 2012
is it possible to block outgonig multicast L2 frames on an Ethernet port in outgoing direction on a 2960 Switch?
I tried the "switchport block multicast" command, but the description of this feature relates to only "unknown" multicast!?
But what means "unknown multicast"? Even if activated, I see a lot of multicast traffic going out that port: IGMP, PIM, SSDP, HSRP, OSPF, .. and also pings and VLC streams to multicastaddresses (ip igmp snooping disabled).
I also tried to map a "mac access-list" to that port, but the "mac access-group" interface command is restricted to only incoming traffic.
Reason: we assume, that there are a couple of specific enddevices, that might react strange to some multicast. Therefor we would like to block outgoing multicast on that specific ports.
I tested it on a 2960 12.2(53)SE2
View 10 Replies
View Related
Feb 8, 2012
I have two switches, a 2960 (sw01) and a 2948 (sw02). The sw01 is trunking via dot1q on Gi0/24 to sw02 on 2/48. Why are VLANs 2-4 not active on sw02?
sw01#sh int Gi0/24 trunk
Port Mode Encapsulation Status Native vlan
Gi0/24 auto 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/24 1-4094
[code].....
View 5 Replies
View Related
Mar 29, 2012
As per my attached diagram, I have three switches (Cat 3560-E and couple of Cat 2960-G)
Each PC is on different vlan
PC -1 on vlan 100
PC-2 on vlan 200
I need to connect PC-1 and PC-2 to the server. Server has no fixed vlan and can be changed.
Restrictions:
1) can’t change PCs vlan assignment.
2) can’t add 2nd NIC in the server.
I’ve tried private vlan but it requires separate physical ports for host and/or community vlan and somehow it did not work. I could be wrong Trunking using dot1q enabled on port 2 on all switches and connection works fine (server to PC-1 or server to PC-2) by enabling switchport access vlan 100 or switchport access vlan 200. However I need port 5 on switch-1 to respond to vlan 100 and 200.
View 11 Replies
View Related
Sep 26, 2012
How can i add two data vlans on cisco 2960 on one interfase? i have 3 mac adresses on one interfase: one PC, one ipphone and one XP virtual machine(VM). PC and VM are in one data vlan and phone is in voice vlan. i need to place the VM in another data vlan is it possible? if so could you give me a link or place information here.
View 2 Replies
View Related
Apr 30, 2012
I have a a hardware server running a VM hosting virtual servers which are all on different VLANs. My challenge now is to configure the switchport that the server is connected to, to see all the VLANs needed by this VM. The VM has an IP that is used for managing the server VMs which is on a different VLAN also.
My switch is a 2960 switch and it is presently trunked from the core switch.
View 3 Replies
View Related
Jul 20, 2011
First of all, I want you to know that I do understand that it's not a good design at all, but I still need to implement it.My ACE20 in 6500 works in routed mode with VLAN 101 (10.0.101.0/24) as the client-side VLAN. I therefore have Vlan101 SVI (10.0.101.1/24) on 6500.I also have VLAN 200 (10.0.200.0/24) on 6500 with SVI Vlan200 (10.0.200.1/24) and I want to create a static bidirectional NAT so that clients, connecting to IP address in VLAN 200 (10.0.200.64) would be NATed to VIP (10.0.101.10).Let's say we have clients (10.0.500.0/24) connecting through gig1/0/1.Here is my current setup on 6500.
View 14 Replies
View Related
May 10, 2012
We have a switch that continues to get unidirectional links. The fiber run is very long and is working off of legacy infrastructure. We have one uplink that can sustain 100MBPS trunk link. However, the moment we plug in the second redundant uplink the port will error disable for unidirectional link. We have tested all of the patch cables involved on the run, replaced the catalyst 3560 v2 switch, and even had a contractor come and out verify the fiber was good between the buildings. No matter what the link will come back as unidirectional. Or any troubleshooting steps we could try next? We have UDLD port aggressive enabled on both the switch interface and the interface on our distro router.
View 2 Replies
View Related
Nov 12, 2012
I am aware that private-vlans are not supported on edge switches like 2960 series - so my question is would it be possibel to ceate private vlans on say just the core switch which would be a 3570 or 4506 that supports private vlans and then just trunk these to the edge like normal vlans?what I need to achive is to have edge port not able to communicate to each other even across switches - which cannot be done using 'protected' port so need the private vlan feature?
View 1 Replies
View Related
Dec 19, 2012
I have two Catalyst 2960 Series (48 port) switches with the newest Cisco IOS installed. There is also a Cisco 2600 Series Router which I can't manage because it's ISP managed.
Now the problem is as follows. I'd like to create two VLANs, one in the IP range 192.168.0.xxx and the other in the 192.168.1.xxx. Now the router has a gateway IP address 192.168.1.1 .
Would it be possible to somehow connect these two VLANs with the router so that these 2 VLANs can't see each other but they can ofcourse both contact the router and exit on the internet?
View 3 Replies
View Related
Nov 22, 2011
On a low-end switch like a 2960 the maximum VLANs is 255, as shown in the output of VTP status:
Maximum VLANs supported locally : 255
Number of existing VLANs : 245
When the VTP mode is changed to transparent, VLANs from the extended range can be added without increasing the number of existing VLANs - e.g. if I create VLANs 3000 - 4000 the number of existing VLANs is still listed as 245.
If MST is used to cut down on the number of spanning-tree instances - and assuming propagation of VLAN configuration via VTP is not required - is there any downside to using transparent-mode VTP to increase the number of available VLANs? It does feel like I'm cheating the maximum listed in the datasheet.
View 4 Replies
View Related
Nov 11, 2012
I am aware that private-vlans are not supported on edge switches like 2960 series - so my question is would it be possibel to ceate private vlans on say just the core switch which would be a 3570 or 4506 that supports private vlans and then just trunk these to the edge like normal vlans?
what I need to achive is to have edge port not able to communicate to each other even across switches - which cannot be done using 'protected' port so need the private vlan feature
View 7 Replies
View Related
Feb 12, 2012
if enabling BFD (Bidirectional Forwarding Detection) for BGP on a Cisco 7609 Router causes extra loading on the CPU or impact on Router performance?
View 2 Replies
View Related
Mar 7, 2012
I've just started a new job after a couple of years not touching cisco gear and been pitched in... My new employer has a network that's Juniper based. We've inherited a load of Cisco switches as part of the deal for hosting matches during the Rugby world cup (plus a load of Aruba wireless gear that promises to be my very own special millstone, but that's bye the bye.)
My task is to hang these catalyst 2960's onto our existing infrastructure via fibre connections.
On the Juniper switch, there are four vlans being pushed to the port the cisco's hooked into: Code...
View 7 Replies
View Related
Nov 3, 2012
I need to block the P2P traffic on a Cisco router. How can do it effectively? I configured NBAR on my router but still users can download using the utorrent client.
View 5 Replies
View Related
Oct 10, 2011
I have a cisco 877 router setup with 2 vlan's and 2 dialers, each vlan routed to a dialer. I have some ports forwarded to my vlan 1 incl vpn traffic. I need to get vlan 2 to be able to vpn to vlan 1, and see some of the servers on vlan 1 which are forwarded from router without allowing normal traffic between the 2?
View 2 Replies
View Related
Mar 21, 2011
This issue is a bit confounding for me, but hopefully simple for one of you. I have two sites, one in Alaska and one in California, connected via 10mb QinQ service from an ISP in Alaska. The ISP is utilizing Verizon from Seattle south who is delivering the circuit on a DS3 here in California. The ISP gear on site here is a Tasman. The Tasman is directly connected to a Cisco 3845 G0/1 with a routing sub interface. In Alaska, the ISP is directly connected to a 6513 which in turn is connected to a 7206 with a routing sub interface. I cannot seem to get the 7206 and 3845 to come up as neighbors.
The 7206 receives the 3845's Hello and the 7206 shows the 3845 as a neighbor until the hold time expires. It does not see updates from the 3845 since the 3845 never sees a Hello from the 7206 and comes up as a neighbor to send an update. The 3845 does see EIGRP updates from the 7206, but no Hello. Pinging 224.0.0.10 from the 7206 does not get a response from the 3845, but it does get a response from many other sites/neighbors, including another site here in California with a nearly identical setup (same provider and gear). I am ableto ping between the devices' routing interfaces. Being QinQ, I don't believe the ISP could possibly be the issue (the circuit is clean and stable) as they don't filter any of our packets. There are no ACLs applied to these interfaces. The 3845 does have other EIGRP neighbors from sites over a TLAN around here in SoCal.
Why the Hellos may not be reaching the 3845? I have verified they're being sent from the 7206.
View 6 Replies
View Related
Apr 22, 2013
where is the best place to block unwanted traffic? By that I mean, should I block it at the router, firewall, IPS? As an example, I'm dealing with DNS flood attacks - probably DDoS and reflection. I have a pair of Cisco 2821 routers with two different ISPs doing BGP. Behind that I have an ASA 5510 with IPS module. Behind that I have 2 public DNS servers. Over the last few days I've seen an increase in bogus DNS queries - high volume, distributed. My question is where is the best place to put the ACL to block them? I've been putting them on the ASA, but when the attack is running, it jacks the CPU to 60%. If I don't put the ACL, the IPS seems to pick them up after a while and the CPU is almost as high as with the ACL. I haven't tried to put the ACL on the routers.
View 2 Replies
View Related
Aug 16, 2012
Is it possible to block outside P2P traffic on a guest wireless network using an ACL on the controller? I know we can do it our firewall
View 6 Replies
View Related
Jan 28, 2013
I'm using ASA 5515X my concern is I was not able to block the traffic of P2P such as BitTorrent etc. I was also view some technotes on how to use webfilter without using Websense or Smartfilter tools and lucky I'm able to block certain websites. how to block the traffic of P2P?
View 2 Replies
View Related
Jan 10, 2012
Is it possible with a 3560 to block all traffic to a certain vlan except for one or two IP addresses? Create an ACL or something? We have a vlan for voice calls (SIP) and we are getting a lot of scnas that are making the phones ring and such, and I think we can stop this if we only allow traffic onto the vlan from the IP's the SIP traffic is SUPPOSED to be coming from.
View 1 Replies
View Related
Aug 20, 2012
I've got an ASA 5505 with the Security Plus license that I'm trying to configure.
So far I have setup NATing on two VLANs, one called 16jda (VLAN 16 - 10.16.2.0/24) and one called 16jdc (VLAN 11 - 10.105.11.0/24).
From each subnet I am able to connect to the internet, but I need these subnets to also be able to talk to each other.
I have each VLAN interface at security level 100 and enabled "same-security-traffic permit inter-interface", and I have setup static NAT mappings between the two subnets, but they still can't communicate.
When I try to ping there is no reply and the only log message is: 6 Aug 21 2012 09:00:54 302020 10.16.2.10 23336 10.105.11.6 0 Built inbound ICMP connection for faddr 10.16.2.10/23336 gaddr 10.105.11.6/0 laddr 10.105.11.6/0
View 11 Replies
View Related
May 30, 2011
I have ASA 5505 Firewall with security plus license, I configured two V LAN 1 and V LAN 5 as my inside V LAN for different sub net, i need to route the traffic between this two V LAN's through ASA. I configured
int vlan 1
nameif inside
Security level 100
Ip address 172.16.100.1 255.255.255.0
[Code] .........
The problem is i am not able to ping other sub net, for ex my PC is in V LAN 1 not able to ping 192.168.22.1 ... For troubleshoot i type debug icmp trace while pinging other subnet
ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=4608 len=32ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=4864 len=32ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=5120 len=32ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=5376 len=32
I turn off the firewall on my local machine.
View 10 Replies
View Related
Sep 22, 2011
I require a system that will support 3 VLANs, the VLANs are purely for containment of broadcast traffic and needs to support inter-VLAN communication between client devices. Would the following configuration work:
Port based VLAN on the SRP527W with each port connected to layer 2 switches serving each VLAN.
DHCP server on the SRP527W assigning IP addresses for each of the V LANS in different ranges. (eg 10.10.1.xx, 10.10.2.xx, 10.10.3.xx). Would there be any benefit upgrading the Router to a SRP547W?
View 2 Replies
View Related
