Cisco :: Implement ACLs In Layer3 Switch?
Oct 15, 2012Is it possible to implement ACLs in layer3 switch??
View 4 Replies
ADVERTISEMENT
Cisco WAN :: 6509-E / ACLs Missing After Reload Switch?
Jan 1, 2012We had an power shutdown activity last week, due to which one of the core switch was turned off and ON .After the core switch was turned ON, we had found some of the ACLs missing which were bounded in VLANs. We had given write command before this power shutdown activity.We need to find the root cause for the same.
Switch Model-WS-CISCO-6509-E.
Cisco AAA/Identity/Nac :: Dynamic ACLs On 2960S Switch Using ACS 5.2
Apr 20, 2011I am testing a ACS 5.2 in our lab environment, I am testing port security for policy based VLAN and ACL assignment. The problem I am having is with the 2960S switches; in my current setup it is working but it doesn't seem to me like it is the way that it should be working. I have a downloadable ACL in the ACS defined and associated to an Access policy and it is working correctly. The problem is, from what I understand, I have to assign a default ACL on the switchport? So what I have assigned on the switchport is ip access-group 10 in. The downloadable ACL from the ACS is also called 10. Do I really need to match the ACL on the switchport with the ACL name I have created in ACS? That doesn't seem like it's dynamic if that is the case? What is the ACL that I should apply to the switch port (if any) in order for the downloadable acls that I configure in the ACS to work no matter what port the user is patched into?
View 2 Replies View RelatedCisco Firewall :: VLANs ACLs In A 3750 Switch Stack
Jan 15, 2013A CISCO 3750-X stack with several VLANs and many ACLs applied to the virtual interfaces. Intervlan routing is on. Connected to this stack are VMware hosts and with about 500 VMs.We started using the ACLs to allow connectivity between VLANs to specific hosts and it has grown to thousands of lines. I personally do not think this is good for the switch and believe the switch was not intended to be used for that security feature.
- Does it make it sense to add an "internal firewall" between the CORE ROUTER AND THE 3750-X SWITCH STACK ?
- Do you recommend any other way?
- Any recommended CISCO resource/white paper to read about best practice
Cisco Switching/Routing :: Implement QOS On 3560 Switch?
Nov 22, 2011I have a 3560-48 switch running Cisco IOS Software, C3560 Software (C3560-ADVIPSERVICESK9-M), Version 12.2(44)SE3 and i need to implement basic QOS commands to the fast Ethernet interfaces as well as the gig interfaces and Also I need to create port channels on the switch and need what the port channel syntax are as well for that particular IOS version?
I have only read only access and i can't see what the QOS and Port channels syntax should be for that IOS version.
Cisco Switching/Routing :: 4507R-E How To Implement Same Configuration On New Switch
Feb 26, 2013I'm in the process of upgrading my 4507R core to a new 4507R-E. The old switch has Sup IV engines (WS-X4515) running IOS 12.2(40)SG and the new switch has Sup 6L-E engines running 15.1(2)SG. I'm trying to "move" my configuration from the old switch to the new. Below shows the commands configured in the old switch. I'm trying to determine how to implement the same configuration on the new switch since these commands are no longer available.
View 2 Replies View RelatedCisco WAN :: SR 520 - Can Layer2 FastEthernet Port Be Upgraded To Layer3
Feb 26, 2012I have a SR520 router with the ADSL WAN built in. I am looking to ignore the ADSL port and utilise the 4 FA ports to route between two networks.Can I configure the ports on the switch part of the router to become Layer 3 and take there own Ip addresses? If so I can save myself the purchase of a new router.I have used loopbacks before but not sure that will work.
View 9 Replies View RelatedCisco WAN :: 4948 Trying To Replicate Config For Qnq Layer3 Interface
Apr 9, 2013I am replacing a 7204 router with a 4948 and am having trouble trying to replicate the config for the qnq Layer3 interface.A bit of background - I am a service provider where I have an interconnect with the carrier, who pass off WAN links to me as a standard VLAN Ids. Some of these VLANs however I can do QnQ.
This works fine - but I can get the second-dot1q 50 command working properly
Cisco Switches :: SG300 10 Layer3 And InterVLAN Routing
Apr 25, 2011I'm trying to get the following running.
I have 4 Subnets
VLAN 1 172.20.0.0/16 with the default GW 172.20.200.254
VLAN 10 192.168.10.0/24 with the default GW 192.168.10.2
VLAN 59 192.168.59.0/24 with the default GW 192.168.59.254
VLAN 130 192.168.130.0/24 with the default GW 192.168.130.254
[Code]....
With absolutly the same settings I did this with an HP E4200-12G L3 Switch (which is now doing the job) so there is no routing mistake in the other components.For me it looks like, the SG300 doesn't like to be NOT the default gateway.
Cisco Switches :: SG300-10 ACL Entry In Layer3 Mode?
Jul 26, 2011I'm setting up two vlans and I would like all of vlan 2 to only have access to the WAN router on vlan1 at 192.168.30.1.
VLAN1 192.168.30.x
VLAN2 192.168.31.x
I've setup the VLANS and static routes and I'm able to access the WAN router at 192.168.30.1 from the 192.168.31.x network and everything is fine.
I'm getting an error setting up the IPv4 based ACL that is designed to allow the 192.168.31.x network access to only the 192.168.30.1 WAN router.
The first rule I setup is to permit source 192.168.31.0 / 0.0.0.255 dest 192.168.30.0/0.0.0.255 to allow all traffic to from the 192.168.31. net to access the 192.168.30.x net. Then I was going to deny the dest of 192.168.30.1-255 but I'm not sure of the wildcard to use for that.
I'm not clear on the wildcards but I'm also getting the following error when I setup the first ACE rule:
"MIB Index is out of range.Index must be bigger then 0 and Existing ifindex.."
I suspect the error is related to how I'm using the wildcards?
Cisco WAN :: 3750 Layer3 Switches - Connect Them Via Stack Cable
Jul 11, 2012I have two 3750 layer3 switches and I need to connect them via stack cable.so if I connect them with the stack they will be act as an one switch, but for the configuration if I create a VLANs on the master switch (applied all the configuration on the master one) this configuration will be transfered to the slave one or I have to repeat the configuration that I did on the master.
View 5 Replies View RelatedCisco Switching/Routing :: 6500 - Outbound Policy On Layer3 Interface
Apr 23, 2012I'm trying to add an outbound policy on Layer3 interface on a 6500. The will be used to prioritize voice traffic. The environment contains 2 sites with 2 6500's each with VSS and a metro Ethernet link between them. I seem to be having problems prioritizing the voice across this link.
View 1 Replies View RelatedCisco Switching/Routing :: 4500 CAT Layer3 To Access Layer And MPLS Design Considerations
Mar 29, 2012We are about to install a new network consisting of Cat 4500s with Sup7E at the Access Layer, with Nexus 7000 at the Distribution and Core layers. We have 14 floors with at least three 4500s on each floor. Within the office block where the Access Layer and Distribution Layer reside we need to support secure borderless networking using 802.1x to place users from different parts of the business into segregated networks at layer 3.All switches will have the feature sets to support MPLS/ VRF / OSPF / EIGRP / BGP etc.We quickly dismissed the idea of using VRF-Lite due to the sheer number of Vlans we would need to managage and maintain, the point to point links alone just to get one additional VRF on each floor required far too many Vlans.As a result we are now considering deploying MPLS. The obvious benefits include scalability and manageability, the fact that all switch to switch links can now be routed, instead of having to using SVIs.
View 2 Replies View RelatedCisco :: ACS 5.2 Downloadable ACLs For WLC
Jun 19, 2011I'd like to set up a downloadable ACL from my ACS 5.2 server to be applied for users authenticating for just one of my SSIDs / WLANs.
I intend to use this primarily for mobile devices to allow them to go to any of my physical locations, connect to the same WLAN regardless of location and then get the same downloaded ACLs (filtered based off of destination port and address) applied in each case.
Cisco :: Configuring ACLs For HSRP
Feb 13, 2013I'm screwing around with HSRP running between two L3 interfaces of routers. I placed an inbound and outbound ACL on the same interface on both of these routers specifying to "permit ip any host 224.0.0.2" Why am I only seeing counters ticking for the inbound ACL of both of these routers? Is it an order of operations thing?
View 3 Replies View RelatedCisco Firewall :: ASA 8.2 Getting ACLs Loss
Jan 23, 2013I'm almost afraid to post since my stuff is so OLD! I have a 350 Series PCI Wireless LAN Adapter in my old WinXP, not wireless-ready Compaq.I live off the grid, no landlines and have been using a Franklin CDU680 USB air card to connect to the Internet. The air card doesn't like my Compaq - occasionally crashes it. I thought to put the air card in a router to solve the problem and communicate with the router using the Cisco 350. Bought a Cradle Point router from my ISP and plugged in the Franklin. Then spent the next 5 days trying to get the Cisco 350 to associate with the router.I now have a profile with the router's SSID in it that according to the ACU's status report is associated with that SSID. Problem is that there is no Internet connection.
View 4 Replies View RelatedCisco :: IPS Configures Router's ACLs Thing?
Mar 18, 2011This "IPS configures your router's ACLs" thing seems like a bad idea to me, other than letting it be it out of line and reducing your IPS's load abit doesn't really seem to really give you any real benefits..
View 1 Replies View RelatedCisco Firewall :: ASA 5505 - Static NAT And ACLs
May 25, 2011Currently a customer has all theLAN devices using a router as the Default Gateway. The router also do the Dynamic NAT to the internet access and has NAT/PAT rules to publish some services like HTTP and FTP. As I know the router will permit all the incoming traffic in all its interfaces without restrictions at less there is an ACLs that restrict the incoming traffic on an specific interface.Now the customer has bought a brand new ASA and wants to use it as the default gateway for the entiery LAN. This means, the ASA will have the internet connection and will be the responsible for the NAT/PAT process.
I have configured the NAT/PAT rules already following the current router configuration, but I need to know if I have to configure ACLs allowing the incoming traffic on th Outside interface for the services I NATed.
Cisco Firewall :: ASA5510 Post And Pre 8.3 NAT And ACLs
Aug 30, 2012In the near future I plan on updating all of my firewalls to 8.4, currently we're on a mix of 8.0 and 8.2. I've heard that if your equipment is on 8.2 there's an auto-conversion feature when upgrading to 8.3. However, I do not want to rely on that and am trying my hand at re-writing the NAT and ACLs myself. Attached is my pre 8.3 ASA 5510 config (santized) and a document that shows the particular sections pre 8.3 and what I think they should be after the upgrade.
View 1 Replies View RelatedCisco VPN :: VPN Filter Vs Interface ACLs On ASA 5525
Mar 19, 2013I need some clarification on the differences between a VPN-Filter v an Interface filter.I am using an ipsec crypto tunnel between our site using ASA 5525 and a remote client who are using a Palo Alto Firewall. I have applied a vpn-filter on the tunnel for these sites but I am being told that an interface filter would have been more simplier.
View 9 Replies View RelatedCisco :: To Configure MAC Based ACLs With AIR-SAP1602I
May 19, 2013I want to buy an AIR-SAP1602I-E-K9 and I don't know if I can configure a MAC-BASED ACL with this AP, because I must permit the access of the wireless netwok only to determined wireless devices.
View 4 Replies View RelatedCisco Firewall :: ASA 5510 - Multiple V LAN's And ACLs
Feb 27, 2013I'm having a bit of trouble determining the best way to do this... I have 12 V LAN's set up (sub interfaces on a redundant group of two NICs) on my ASA 5510. On several of these, I want them to be able to access the internet but not access other V LAN's.
By default, they have a rule like "any to any less secure", and since the outside interface has a lower security level, this works great. But if I create an ACL on the interface, this rule disappears. I can restore internet access by adding an "any to any" or "(this interface's sub net) to any" rule, but this seems to imply that it allows access to any v LAN. Do I have to create a set of "deny" rules for each V LAN, on each V LAN, followed by an any-any rule to allow internet access, or is there a cleaner approach?
Cisco Firewall :: Configuring ACLs 3560 In A Lab
Dec 27, 2011In my lab setup i configured Cisco 3560 switch.
VLAN 20 and VLAN 30 i configured.
VLAN 20 interface IP : 192.168.20.1/24
VLAN 30 interface IP : 192.168.30.1/24.
Inter-vlan communication is happening fine.
For testing for purpose i configured extended ACLs. Here is my requirement: I want to stop communication from VLAN 30 to VLAN 20 but not vice-versa.
Here i configured like this:
access-list 111 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 111 permit ip any any
applied ACL in VLAN 30 interface 'in' direction.
ip access-group 111 in
In this scenario, communication is stopping in both directions. If i ping from one of the IP VLAN 20 to one of the ip of VLAN 30, i was gettng Requested time out. And if i ping from one of the IP VLAN 20 to VLAN 30 interface IP, i was able get pinging.
From VLAN 30 to VLAN 20, i was getting destination host unreachable from VLAN 30 ip( Its fine as its my requirement). So, solution needed to communicate from VLAN 20 to VLAN 30.
Cisco Switching/Routing :: 3750G ACLs Not Working
Sep 17, 2012I am trying to create an ACL that walls off a VLAN and only allows it to the internet. This is on a 3750G, currently the 3750G I am attempting this on is in a stack. I have another 3750G that is a standalone.
The first way I attempted this was to create two access-lists: access-list 101 permit tcp 10.249.1.0 0.0.0.255 any eq 80 access-list 102 permit tcp any 10.249.1.0 0.0.0.255 established
Let's call the 10.249.1.0 VLAN 2. I applied this to the VLAN2 interface, 101 out, 102 in. It didn't work. If I place a deny statement with nothing else, that works.
The second attempt was this: access-list 101 deny ip 10.249.1.0 0.0.0.255 any access-list 101 permit ip any any
I applied this to a VLAN I wanted to block VLAN2's traffic from reaching, let's call that one VLAN 3.
This lets all traffic from any VLAN (including the one I'm trying to block). If I remove the "permit ip any any", then all VLANs are denied. Which I understand is correct due to the implied deny all. What I don't understand is why it isn't applying the ACL to the specific VLAN.
Cisco Firewall :: ASA 5505 ACLs On Ethernet Interfaces
Aug 18, 2011It is my understanding that ACLs can only be bound to logical interfaces using the access-group command. However, is it possible to somehow apply ACLs simply based on the ASA's local Ethernet interface? For instance, consider the following:
Device A with IP 192.168.1.1/24 is connected to Ethernet0/0 on the ASA. Device B with IP 192.168.1.2/24 is connected to Ethernet0/1 on the ASA.
Since both devices are in the same subnet and presumably the same VLAN, is it possible to manipulate the traffic to and from physical Ethernet interfaces using ACLs in this manner?
My predicament is fairly simple:
Internet --- ASA --- ROUTER
|
DMZ
In addition to NAT, VPN, and various other tricks, my ASA is also routing traffic from my internal LAN and the Internet to servers in the DMZ configured on the ASA. Due to a combination of Internet and DMZ traffic, my relatively slow ASA is struggling to route and thus becoming a bottleneck. My router is comparatively modest in terms of functionality when compared to the ASA but it is fast. My ideal solution would be to somehow harness the ASA's filtering capabilities for my DMZ but use the router to get traffic to and from my internal LAN into the DMZ without using the ASA to route it.
Additionally, it is worth noting that my DMZ is fairly restrictive so using protected or isolated ports would not quite work for me.
Cisco Wireless :: 5508 Single SSID / Two ACLs
Jul 16, 2012I am setting up a Cisco 5508 wireless controller and was looking for some feedback or assistance. Basically I already have my guest SSID configured and functioning. Created an interface group containing my vlans and applied the created ACL "Guest Policy - internet only", which is also working.I want to setup a second SSID called "staffstudent" and use RADIUS for authentication. I have already created two separate network policies on the radius server: staff and student. Each only allows certain user groups. I want to be able to differentiate on the controller side which profile they are logging in on and then apply the correct ACL. I have two currently configured: one for staff and one for student. It appears to me that since you have to apply the ACL at the interface level I cannot use both since my interface is accepting both staff and students. Is there a way I can filter them using RADIUS so that when they login RADIUS can return a "student" value and then apply the correct ACL? Same for staff?
View 2 Replies View RelatedNetworking :: Cisco 2621 ACLs Blocking All Deployments
May 9, 2011How would I go about only allowing the traffic that I have acl's set for and blocking any other traffic?
Just as an example say I have an acl that allows traffic from 192.168.1.0 to 192.168.2.10,How would I go about setting it up so that no other traffic can occur such as http traffic from 192.168.3.20 to 192.168.1.10
I'm hoping there's a way to deny everything and then only allow what I want. It would seem crazy if I would have to deny every single protocol from every possible action.
Cisco Firewall :: ASA 5505 - Bypassing ACLs Online
Sep 22, 2011I implemented an ASA5505 on an access switch on a network with a single data vlan1. When I put the device online, none of my ACL's were being matched.
View 3 Replies View RelatedCisco Switching/Routing :: SW 3750 - ACLs For DHCP
Apr 16, 2013We are configuring ACLs for a dhcp pool on Sw3750
ip access-list extended Test
permit ip any 192.168.1.0 0.0.0.31
permit ip any host 172.16.1.1
And, here is dhcp pool:
ip dhcp excluded 192.168.1.1 192.168.1.3
ip dhcp pool Name
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
But when a PC try to obtain IP automatically, it doesn't work.
Cisco Switches :: SG300 VLANs - Routing And ACLs
Jan 20, 2013I have a SG300-28P that is our Main VLAN Switch. Though the VLANs that I have on it are there mostly because of our Edge Router and our AP541Ns.We have the Following VLANs defined (Subnets Changed to conseal Piblic IPs) [code]
VLAN200 and VLAN201 come into Our Edge Router and out on a Single GE Port via VLAN Tagged to thje SG300.The SG 300 Splits them out to Untagged Ports and they are connected to Two Firewalls, each with a IP in the 200 and 201 Subnets. The AP510 has the VLAN200, VLAN192 and VLA101 tagged Subnets sent to it. The AP521 has three SSID, each associated with a Paticular VLAN.
This all works fine, though there are a few hidden flaws. Since all of the VLANs are present, both Internal and Public IPs, one could craft packets form one network and use the SG300 as its gateway to the other subnet and Gain Access. How can I isolate the Subnets, so that I can still use the SG300 as a Default Gateway for the 10.1.0.0/16 Network Make it so if someone from the 10.1.0.0/16 netwok accesses the 201.201.201.0/24 Subnet it uses the SG300's 0.0.0.0 0.0.0.0 default router (the Firewall IP) and not the VLAN InterfaceIf somone in the 201, 200, 192 Subnets uses the SG300 as a Gateway and tries to access a 10.1.0.0/16 address it gets blocked.
Cisco WAN :: 1841 - Named Versus Numbered ACLs
Dec 27, 2010In my test lab I am playing with the Numbered ACL's and Named ACL's. Both configurations are working BUT , I am sure I do something wrong in the Named ACL's version. When I reboot or reload the CISCO 1841 ROUTER , I do not have INTERNET anymore , I still have access by TELNET or SSH , but no external communication anymore. The only way to start the communication again , is by adding :
PERMIT IP ANY ANY . This will of course work , but the funny thing is that when I do a : NO PERMIT IP ANY ANY It still works !!!
I have learned by this to always shut down and restart my ROUTER or SWITCH to see if everything still work . Here bellow some parts of the working Numbered ACL's version :
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh port 8096 rotary 1
ip ssh version 2
[ code] ....
Cisco :: Full Access To Everything Since The Tunnel Is Set To Bypass Interface ACLS?
Nov 23, 2011I have ip phones at the remote location that connect into the phone switch(it's a nortel cs1000 system) over the tunnel. Internal calls work just fine, however when somebody calls from the outside, or calls are made to the outside the connection is never finalized. Like if I call from my cell it rings the phones, but when I answer there is nothing but dead air.In the group policy for the tunnel, I gave the remote site FULL access to the phones vlan and vice versa...which obviously works since internal calls work fine. If I remove my group policy and give it the Default group policy which essentially gives that tunnel full access to everything since the tunnel is set to bypass interface ACLS, external calls work fine. So it's definitely related to the group policy.
The group policy is basicallyAllow remote site to X network/host on these ports no denies since it blocks whatever isn't specifically allowed. However since it can get the phone switch and it can get to the internet I'm not seeing why the calls aren't working.The only thing I can think of to try doing as well is remove the allow inbound traffic to bypass interface rules and treat it just like another vlan interface on the ASA. Create the rules on each interface for the remote site network etc and see if it works that way.
Cisco :: ACLs To Limit Ports With Client - Based VPN Tunnel
Jun 16, 2011I have a customer I've built a webvpn tunnel for.Users on this tunnel need to have http access to a server at 10.1.1.12 and nothing else.That's fine, but in order for name resolution to work properly they need to be able to send DNS requests to 10.1.1.9.I'm working with two different access lists, my non access list (nat 0) and my split tunnel access list. I can't specify ports in the nat 0 access list, but I did try writing my split tunnel access list as follows:
-access-list split permit ip host 10.1.1.12 172.16.4.0 255.255.255.0
-access-list split permit udp host 10.1.1.9 eq 53 172.16.4.0 255.255.255.0
When I do that users can access the 10.1.1.9 dns server, but they can hit it on anything (ping, 3389, etc.).I'm trying to figure out how I can limit them so they will only be able to pull dns but nothing else.They have the Any connect Essentials license, so unfortunately a clientless VPN is not an option. Is there some other access list I can interpose that will limit things the way I want?