ACL (SVI)

Similar Questions

• Pls explain the sense of source and destination SVI ACL

  Hi I have a home network up and well running that uses a Cisco 1801.

  I'm just trying to increase my understanding of some is the config and I'm confused by ACL on an interface VLAN.

  OK so I "be the router" and imagine packets flowing to me and me

  I have two VLAN configured

  VLAN 10 - 10.10.10.0 / 25

  VLAN 20 - 10.10.10.128/27

  So, for example, one of my Virtual Machines has the address of 10.10.10.6 and is on VLAN 10.

  Another is the 10.10.10.134 address and VLAN 20.

  I want to allow 10.10.10.6 Access 10.10.10.134, but keep the other VLAN 10 access devices.

  So I create an ACL and apply it to interface Vlan 20 entrants.

  The configuration below works as you want, but I don't understand why.

  If packet filtering is for the incoming direction of the interface, then my logic would state that the source address of the packet filter would be 10.10.10.6, not 10.10.10.134.

  Can someone help me understand. Thank you.

  interface Vlan20
  ip access-group ACL-INBOUND in
  !
  ip access-list extended ACL-INBOUND
  permit ip host 10.10.10.134 host 10.10.10.6 log-input
  			 
  That is to say, a vlan SVI is no different from a physical interface with respect to an acl.
  to apply an acl entering traffic control devices SVI in this vlan
  apply an acl Outbound IVR auxdispositifs controls traffic to that vlan
  I want to allow 10.10.10.6 Access 10.10.10.134, but keep the other VLAN 10 access devices.
  access-list 101 permit ip host 10.10.10.6 10.10.10.134
  access-list 101 deny ip 10.10.10.0 0.0.0.127 host 10.10.10.134
  access list 101 ip allow a whole
  int vlan 10
  IP access-group 101 in
  the acl above allows 10.10.10.6 to talk to 10.10.10.134 but blocks all other 10.10.10.x/25 customers to talk to 10.10.10.134. Then, it allows customers to 10.10.10.x/25 to talk to everything else. Note You can not only "permit ip any any" at the end, but you will want to probably other lines permit while I have included a general all allow.
  I hope you see it's the same concept applies an acl to a physical interface in terms of incoming and outgoing traffic. Whence came the confusion was probably that you have applied the acl to vlan 20 then he effectively blocked the return circulation and not the original packet from to vlan 10.
  It is usually best to filter packets to their source.
  Jon
  		   

• VLAN ACL M4100

  Dear Sir

  We want to create an access list to isolate our Wifi network invited all the other vlan.
  When I do, diseapper of the other SSID of our laptops.

  I applied to the access list to our direction to SVI comments in

  ! Description of the system "M4100 - 24 G - POE + ProSafe 24 port Gigabit L2 + Managed Switch w ith PoE +, 10.0.2.13, B1.0.1.1"
  ! Version of the software system "10.0.2.13".
  ! System Up Time "28 days 22 hours 39 minutes 58 seconds"
  ! Other packets QOS, IPv6, routing
  ! Current SNTP synchronized time: SNTP last attempt status is not successful
  !
  database of VLAN
  VLAN 99 200-208 455-456 999
  VLAN 99 name 'TEST '.
  name of VLAN 200 'Clients '.
  name of VLAN 201 "Telefonie.
  name of VLAN 202 "guest."
  name of VLAN 203 'fr '.
  the name of VLAN 204 "TD."
  VLAN name 205 "DMZ".
  VLAN name 206 'printers '.
  VLAN name 207 'media '.
  VLAN 208 name 'Wireless '.
  VLAN name 999 "3com".
  VLAN 1 1 routing
  -Other - or ITU (q)
  VLAN 200 2 routing
  VLAN 201 3 routing
  VLAN routing 202 4
  VLAN routing 5 203
  VLAN routing 204 6
  VLAN routing 205 7
  VLAN routing 206 8
  VLAN routing 9 207
  VLAN routing 10 208
  VLAN routing 11 455
  VLAN routing 12 456
  VLAN routing 99 13
  output

  network mgmt_vlan 203
  IP http secure server
  Configure
  time range
  default IP gateway - 10.253.255.1
  level of 483f42190380e8780a9d32a3c63d31b86d6ad49b870db8306af86a9ce3e06cd9a39f66e666e86f0aaab777b0ab9fe571908247c31d904463d1a0767400f8e763 user name 'admin' password encrypted 15
  level password user name "secit" encrypted 15 912ba98d721224814ea15db6dec1701819e75dfcafa635831e9eab148c105c20ba85dc61882dd47a65eb66dff6cf0005a1a2232b6957ec898cd6187c6bdbb510
  line console
  output
  -Other - or ITU (q)

  line telnet
  output

  ssh line
  output

  spanning tree bpduguard

  !

  IP access-list ACL_Wizard_IPv4_0
  output

  IP access-list Deny_Guest_Intervlan_Routing
  deny ip 10.253.2.0 0.0.0.255 10.253.0.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.1.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.3.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.4.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.5.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.6.0 0.0.0.255
  -Other - or ITU (q)
  deny ip 10.253.2.0 0.0.0.255 10.253.7.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.8.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.9.0 0.0.0.255
  deny ip 10.253.2.0 0.0.0.255 10.253.11.0 0.0.0.255
  IP 10.253.2.0 allow 0.0.0.255 0.0.0.0 0.0.0.0
  output

  class-map correspondence ClassVoiceVLAN ipv4
  game of vlan 201
  output

  Policy-map PolicyVoiceVLAN in
  class ClassVoiceVLAN
  Assign-queue 3
  output

  output

  interface 0/1
  Description "ACCESSPORTS.
  participation of VLAN include 200-201
  VLAN tagging 201
  -Other - or ITU (q)
  output

  interface 0/2
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 1000000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/3
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201 204
  VLAN tagging 201
  -Other - or ITU (q)
  IP mtu 1500
  output

  interface 0/4
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/5
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 1000000
  pvid VLAN 99
  participation of VLAN include 99 200 - 201
  -Other - or ITU (q)
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/6
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/7
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  Description "ACCESSPORTS.
  pvid VLAN 203
  -Other - or ITU (q)
  participation of VLAN include 200-201
  VLAN tagging 201
  output

  0/8 interface
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/9
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  -Other - or ITU (q)
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/10
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/11
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  -Other - or ITU (q)
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/12
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/13
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  -Other - or ITU (q)
  bandwidth 100000
  pvid VLAN 200
  VLAN automatic participation 1
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/14
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  VLAN automatic participation 1
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  -Other - or ITU (q)
  interface 0/15
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  VLAN automatic participation 1
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/16
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 202
  VLAN automatic participation 1
  participation of VLAN include 201-202
  VLAN tagging 201
  IP mtu 1500
  output
  -Other - or ITU (q)

  interface 0/17
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 200
  participation of VLAN include 200-201
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/18
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 203
  participation of VLAN include 200-201 203
  VLAN tagging 201
  IP mtu 1500
  -Other - or ITU (q)
  output

  interface 0/19
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 206
  VLAN automatic participation 1
  participation of VLAN include 201 206
  VLAN tagging 201
  IP mtu 1500
  output

  interface 0/20
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 999
  participation of VLAN include 200-201 204-207 455-456 999
  -Other - or ITU (q)
  VLAN tagging 200-201 204-207 455-456
  IP mtu 1500
  output

  interface 0/21
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  pvid VLAN 455
  VLAN automatic participation 1
  participation of VLAN include 200-204 455-456
  VLAN tagging 200-204
  IP mtu 1500
  output

  interface 0/22
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  -Other - or ITU (q)
  switchport mode trunk
  switchport trunk vlan native 456
  pvid VLAN 456
  VLAN automatic participation 1
  participation of VLAN include 200-204 456
  VLAN tagging 200-204
  IP mtu 1500
  output

  interface 0/23
  VLAN 201 votes
  policy - PolicyVoiceVLAN
  bandwidth 100000
  switchport mode trunk
  switchport trunk vlan native 456
  pvid VLAN 456
  participation of VLAN include 200-204 456
  VLAN tagging 200-204
  IP mtu 1500
  output

  -Other - or ITU (q)

  interface 0/24
  bandwidth 100000
  switchport mode trunk
  switchport trunk vlan native 999
  pvid VLAN 999
  participation of VLAN include 200-208 455-456 999
  VLAN tagging 200-207 455-456
  IP mtu 1500
  output

  interface vlan 1
  Routing
  DHCP IP address
  output

  interface vlan 200
  Routing
  -Other - or ITU (q)
  IP 10.253.0.1 255.255.255.0
  output

  interface vlan 201
  Routing
  IP 10.253.1.1 255.255.255.0
  output

  interface vlan 202
  Routing
  IP 10.253.2.1 255.255.255.0
  IP access-group Deny_Guest_Intervlan_Routing vlan 202 in
  output

  interface vlan 203
  Routing
  IP 10.253.3.1 255.255.255.0
  output
  -Other - or ITU (q)

  interface vlan 204
  Routing
  IP 10.253.4.1 255.255.255.0
  output

  interface vlan 205
  Routing
  IP 10.253.5.1 255.255.255.0
  output

  interface vlan 206
  Routing
  IP 10.253.6.1 255.255.255.0
  output

  -Other - or ITU (q)

  interface vlan 207
  Routing
  IP 10.253.7.1 255.255.255.0
  output

  interface vlan 208
  Routing
  IP 10.253.8.1 255.255.255.0
  output

  interface vlan 455
  Routing
  IP 10.253.255.2 255.255.255.0
  output

  interface vlan 456
  -Other - or ITU (q)
  Routing
  IP 10.253.11.1 255.255.255.0
  output

  interface vlan 99
  Routing
  IP 10.253.9.1 255.255.255.0
  output

  IP management vlan 203
  dhcp service
  pool IP dhcp "Telefonie.
  Rental 7 0 0
  Server DNS 8.8.8.8 8.8.4.4
  router by default - 10.253.1.1
  Network 10.253.1.0 255.255.255.0
  domain secit.be
  b-node NetBIOS node type
  output

  -Other - or ITU (q)
  pool IP dhcp "guest."
  Rental 0 12 0
  Server DNS 8.8.8.8 8.8.4.4
  router by default - 10.253.2.1
  Network 10.253.2.0 255.255.255.0
  secit domain name - guest.be
  b-node NetBIOS node type
  output

  pool IP dhcp 'media '.
  Rental 0 12 0
  10.253.3.2 DNS Server 8.8.4.4
  router by default - 10.253.7.1
  Network 10.253.7.0 255.255.255.0
  secit domain name - media.be
  b-node NetBIOS node type
  output

  pool IP dhcp "TD."
  Rental 0 14 0
  10.253.3.2 DNS Server 8.8.4.4
  router by default - 10.253.4.1
  Network 10.253.4.0 255.255.255.0
  -Other - or ITU (q)
  secit domain name - td.be
  b-node NetBIOS node type
  output

  pool IP dhcp "internal."
  Rental 7 0 0
  10.253.3.2 DNS server
  router by default - 10.253.0.1
  Network 10.253.0.0 255.255.255.0
  domain fixitsolutions.local
  b-node NetBIOS node type
  output

  output

  Maybe it's the DHCP packet filtering.

  For help, try to add a rule to allow DHCP packets.

  Example: (this is obviously NOT the exact rule to filter only the DHCP packets, but just a simple rule for the test)

  IP access-list Deny_Guest_Intervlan_Routing
    permit udp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 67
    permit udp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 68
  
    deny ip 10.253.2.0 0.0.0.255 10.253.0.0 0.0.255.255
  
    IP 10.253.2.0 allow 0.0.0.255 0.0.0.0 0.0.0.0
  
  output

  If this ACL works (you can get the DHCP address), then you will need to write the ACL right, something like (this is just an example):

  IP access-list Deny_Guest_Intervlan_Routing
    ! DHCPDISCOVER
    permit udp 0.0.0.0 0.0.0.0 eq 68 255.255.255.255 0.0.0.0 eq 67
    ! DHCPOFFER
    0.0.0.0 eq 67 255.255.255.255 0.0.0.0 eq 68
    ! DHCPINFORM
    permit udp 10.253.2.0 0.0.0.255 eq 68 255.255.255.255 0.0.0.0 eq 67
    ! DHCPACK
    0.0.0.0 eq 68
    permit udp 10.253.2.0 0.0.0.255 eq 67 255.255.255.255 0.0.0.0 eq 68
    ! Internal traffic
  
    deny ip 10.253.2.0 0.0.0.255 10.253.0.0 0.0.255.255
    ! Internet traffic
  
    IP 10.253.2.0 allow 0.0.0.255 0.0.0.0 0.0.0.0
  
  output

• ACL router and Switch

  Hello.

  I have a small question.

  I implemented a simple extended ACL.

  ip licensing 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

  refuse an entire ip

  It is enabled on the SVI interface IN direction with ip 10.10.10.1/24.

  When I test with the ping from the router to a network blocked from using the interface (SVI) source ACL does not work.

  Example: ping source 172.16.1.5 10.10.10.1 = success.

  This should not be blocked and only allow traffic to 192.168.1.0/24?

  So my questions. The ACL effect on the interface of the router itself and only other hosts on the subnet / vlan? (I think I remember having read about it, but can't find it)

  Thank you.

  Hi traffic there, navigate the interface so that the ACL to be considered. Here is a link to another thread on the forum that explains this very well:

  https://supportforums.Cisco.com/discussion/12043016/pls-explain-SVI-ACL-source-and-destination-direction

  I hope this helps!

  Thank you for evaluating useful messages!

• SG300 IP ACL link bug

  Hi all

  Installation of 2 switches SG300 (latest firmware) in a small network gave me the following challenge:

  How can I link an IP ACL to VLAN instead of a physical port?

  The situation:

  -1 Central SG300-20 trunk of layer 3 city to L2 SG300-10.

  -1 remote SG300-10 in layer 2, including the L3 SG300-20 trunk.

  -Several VLANS on both switches, including their IVR on the L3 and InterVLAN routing on the switch switch L3 activated.

  -Would be nice if the traffic between them VLAN in some way may be limited hollow ACL.

  Problems of the ACL to the ports linking instead of VLAN:

  -Port membership regarding the different VLAN is very non-bobines, so the use of 'interface' is not possible to 'mirror' of the administration of the ACL to the administration of VLAN. Moving ports through VLANss creates an ACL administration "gene."

  -More important; What remote ports on layer 2 switch (the other side of the trunk)? How can I link several ACL on the L3 switch to the ports of the physical L2 switch different? Hollow InterVLAN traffic of the trunk should also be limited by the ACL on the SG300-20 L3...

  How can I accomplish this?

  Rommel salvation

  How can I link an IP ACL to VLAN instead of a physical port?

  It is not supported at this time, the link is for LAG and port only, not a virtual interface.

  -Would be nice if the traffic between them VLAN in some way may be limited hollow ACL.

  The ACL works for traffic of penetration which can only be descriminated by several different methods. As a SVI is the interface VLAN, you can distinguish the subnet or specific IP addresses contained in actually making the access rules for the VLAN even if she is not related to the virtual interface.

  -More important; What remote ports on layer 2 switch (the other side of the trunk)? How can I link several ACL on the L3 switch to the ports of the physical L2 switch different? Hollow InterVLAN traffic of the trunk should also be limited by the ACL on the SG300-20 L3...

  The same traffic VLAN, a layer 2 device could tip locally. Communication inter - VLAN traffic to be sent to the routed interface. As traffic is only limited penetration on the SX300 I do not see a complication, as a request of 2 connected device layer would be entered in the port of switch Sx300.

  The only thing that I can determine the post, is that you can have a hell of a large ACL according to restrictive how you want to be with specific host connections. Just keep it minus 512 ACE since that's what the switch takes care of.

  -Tom
  Please mark replied messages useful

• What possible sense to apply ACLs

  Hello

  I'm adding ACL to lock the LAN environment and my heart is a 4510 + R.  I want to block port 80, 443 and 8080 to enter the network.  My security guy tells me users use ports 80, 443 and 8080 to exit and return web services use other ports.   I want to use an access list extended to people like:

  NO_HTTP extended IP access list

  TCP refuse any any eq 80
  TCP refuse any any eq 443
  TCP refuse any any eq 8080
  allow an ip

  My confusion is: which direction on my SVI enforce this ACL if I want users to be able to access websites but block incoming traffic on 80, 443 and 8080? All the information that I have read says to apply ACLs extended as close to the source as possible.  With a SVI, which resembles a box gray?

  Any kind of clarification on this would be helpful and appreciated.

  Thank you very much in advance,

  Kiley

  I think you should apply the OUT access list from the perspective of the SVI. Is means that traffic will be the process of access list after having routed out of the interface in other words the origin of packages outside GOES OUT to your local network.

• When to use the filter VLAN vs SVI-list of access on the switches?

  If VLAN 10 is a user of 10.10.10.0/24 subnet, VLAN and I want torestrict which servers can access these users in VLAN 10, I can configure an access list and apply the ACL of a VIRTUAL local network access plan or apply the ACL on the SVI "interface vlan 10. What is a good practice as much as when I use a VIRTUAL local network access plan and when I apply the access list directly to SVI?

  Thank you very much

  VLAN-access plans are used when you want to restrict the hosts in a vlan. If you have a server and host in vlan 10 and you want to restrict this host to access the server, you must use a virtual local network access card.

  On the IVR access lists are used when you want to restrict intervlan routing between VLANS. If you have a host in vlan 10 and a server in vlan 15, you would use a normal ACL applied to the svi vlan 10, restricting the host to access the server in vlan 15.

  HTH,

  John

  Please note the useful messages *.

• Inter-Vlan ACL

  Hi all

  I'm having some trouble getting the ACL work they way I want. I have a lot of clients in differnet VLAN (vlan 6-10) and my ASA (10.1.99.254) on vlan 99 for internet access. I need VLAN 6-10, to have access to the ASA for internet, but VLAN 6-10 should not have access to the other. For the moment, I do apply the access group of rules in the directon out on the vlan 6 SVI.

  VLAN 6-10.2.1.0/24

  VLAN 7-10.2.2.0/24

  VLAN 8-10.2.3.0/24

  VLAN 9-10.2.4.0/24

  I tried

  10 permit ip 10.1.99.254 0.0.0.255 10.2.0.0 0.0.255.255

  20. denying a whole

  I could do a ping of the ASA and made was not able to access the other vlan. However, I also don't no matter what internet access. DNS responses are not passed without traffic ICMP passed the ASA.

  The switch is a 3560G

  Any help would be appreciated.

  Robert

  The acl should not prevent the devices in the same vlan talk to each other, it will stop devices outside of this vlan only so what you see is not good.

  Regarding your general question, usually you use inbound ACL on the source rather than outgoing ACL on the destination VLAN vlan. You can use either but blocking the packets at the source is the most common approach.

  So if I understand correctly, you need to block all traffic between any vlan 10.2.x.x/24 subnet?

  If so and you are not bothered on the specification of the source IP subnet in each acl.

  extended IP access list

  deny ip any 10.2.0.0 0.0.255.255

  allow an ip

  int vlan 10

  IP access-group to

  So let's say vlan 10 is 10.2.5.0/24. What the foregoing, block any package from clients in the vlan 10 with a IP address of destination of 10.2.x.x. All other packets will be allowed. This same acl could apply to all L3 10.2.x.x VLAN interfaces.

  Note that, in the acl, I used the source of everything rather than "10.2.5.0 0.0.0.255. This is because with 'all' the same acl could be applied to all the 10.2.x.x VLAN entering without any modification. You can if you want to be more specific to a specific acl for each vlan that is to say. for the same example above.

  extended IP access list

  deny ip 10.2.5.0 0.0.0.255 10.2.0.0 0.0.255.255

  IP 10.2.5.0 allow 0.0.0.255 any

  It would be more specific and would stop to any client no 10.2.5.x on this vlan to send packets, but most of communication would not work in all cases that the return should not would be routed packets properly to the customer.  But like I said this makes the unique acl to the vlan specific so you would need different ACLs by vlan.

  A few additional points-

  (1) if clients use DHCP and the DHCP server is a 10.2.x.x device that you need to allow that, before the line to deny

  (2) customers will not be able to ping to their default gateway, that is to say the interface vlan L3. This isn't a problem because the destination IP address is never usually the interface vlan L3, but if you want to be able to do you need an online permit before the line to refuse. Also note that this means that your acl would be different for each vlan, IP because of the vlan L3 is different by vlan

  (3) If you use the same real acl for each interface vlan all hits on the acl will be for all the VLANS so you will not be able to see visits by vlan. This may or may not be important to you. Often, this is why you see unique ACL (in terms of number or name but not necessarily input) use. If you do not want to see the visits by vlan and then simply to reproduce the acl, but with a new name by acl (assuming that you go with the ability to use 'everything' in your ACL).

  Hope all that makes sense. Doubts please ask for more.

  Jon

• Reset home folder permissions and the default ACL on macOS Sierra?

  A tool that I've used in the past to troubleshooting doesn't seem to be available in macOS Sierra.

  There was a procedure in el captain to reset the permissions of file and ACLs in start in recovery mode, by running the command terminal, resetpassword.  This command pulls up a GUI in Sierra as el cap but the "reset the user permissions and ACLs" option is no longer there.

  This article describes the procedure to el captain

  http://appletoolbox.com/2016/07/fix-corrupt-user-accounts-MacOS/#For_El_Capitan _ andmacOS

  Is there another way to reset the permissions of the user and the default ACLs on macOS Sierra?

  If you are looking for in the forums on the topic and limit to messages by Linc Davis, he posted a script that will reset everything.

• How to set ACLs for a volume?

  Hello

  I'm sharing installation points on my external hard drive (in El Capitan Server) and he said:

  "Failed to save the access control list.  Make sure that the access control lists are enabled on the volume. »

  There used to be a way to do it from the server application.

  Can any tell me how to proceed?

  Thank you!

  A few things to look at.

  First of all, if it is a new drive, you reformat to make sure it is formatted in HFS +?  Some external drives are preformatted with alternative formats of partition.  For example, if the drive is formatted in FAT I think not that he supports the ACL.

  Then, if the drive is formatted in HFS +, there is a chance that your player is set to ignore permissions.  Select the drive in the Finder and information.  Reveal the section sharing and permissions of the window read the information.  Check the status of the 'ignore property on the Volume' and make sure it is not checked.

  Also, I suggest that you do not share an entire drive.  Instead, create a folder on the root of the drive and then created folders within the folder.  The reason is that the root of the disc contains a number of hidden files that have specific uses.  For example. Spotlight is to search for and .fsevents for file system events.  You don't want mess you with permissions on these hidden folders.

  Reid

  Apple Consultants Network

  Author - "El Capitan Server - Foundation Services.

  Author - "El Capitan Server - Collaboration & control»

  Author - "El Capitan Server - Advanced Services '.

• ACL work properly with 10.11.3?

  I upgraded a few weeks before 10.11.3 on my server and I noticed that new files created from client computers (actions) are now owned by the creator instead of the group. They user is not yet listed in the ACL is only the group. In fact for other users cannot delete the files that must be deleted.

  I use the server to change the permissions using the ACL and that worked great, but after the upgrade, it's just like using the Finder to change (POSIX) permissions when I used to have all the problems.

  Y at - it something I am doing wrong? or something that has allowed?

  Thanks for any help.

  I've noticed that new files created from client computers (actions) are now owned by the creator instead of the group.

  A folder can never belong to a group.

  The owner of any file/folder is always a 'user '.

  Customers use AFP or SMB?

  If SMB: activate ACL for the SMB shared files, run this command on the server:

  sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server lock - bool YES

  sudo serveradmin stop smb

  sudo serveradmin beginning smb

  If you still have problem, please create a folder then check/post the permissions of the parent folder and it's new.

  LS - lde/Path/Parent/NewFolder

  LS - Parent/road/lde

  Jeff

• Does anyone know if the ACL of HP2011 series widescreen has speakers?

  The screen wide ACL of HP2011 series have speakers?

  Hello

  I believe that the link above shows wrong information on the speakers. Please use the following manual to check again (#15 page) because there are few models for the complete series:

  http://h10032.www1.HP.com/CTG/manual/c03351672.PDF

  It seems that some models have output for speakers, not integrated as mentioned in page #2:

  External USB speakers amplified with audio cable supplied (some models)

  Kind regards.

• WLAN Access Denied for active MAC address in the ACL

  I have a pretty great list ACL (Access Control) and I've never had a problem with it in the past, but I just got a new laptop and same computer when I save the MAC address and reboot the router I always get the "WLAN Access Denied" error for access from your laptop.

  I did all the "sanity checks" to ensure that the password is correct and that other devices still work.

  I had the MAC address of the laptop the same way, I always have, I see the MAC address in the Logs in the access denied message and copy it from there, in the access list. I did it with more than 20 other devices successfully, I'm not sure what is different about this one MAC address... I confirm through ipconfig on the laptop that the MAC address I use is correct.

  When I turn off ACL, I can connect without any problem of the laptop.

  Any thoughts? I am very familiar with computers and you can do an advanced troubleshooting, I do not know infrastructure and networks of the stuff so I don't know where to start here.

  Any ideas on how I can fix this would be appreciated!

  You may have hit a limit of the ACL. A test, remove a device from your list and see if your laptop will connect. This would confirm if you have contributed the most to list ACL on the router...

• Help! ACL MASSIVE corruption

  It seemed to me have made a colossal mistake to set up my iMac.

  I split the drive HARD internal into two partitions: OS X = P1 P2 10.10.5, = OS X 10.7.5.  All updates applied

  Here is was I think I was wrong:

  I installed OS X Server 5 on the partition of Yosemite, AND OS X Server Lion on the Partition of Lion.  I did this, so I could do some tests with server on both systems.

  Everything worked well and I was able to switch between the two partitions, testing various settings, including VPNS.

  However, last week, after doing some work in Lion, when I rebooted in Yosemite, I've was besieged with ACL errors and messages 'cannot access Library.

  I ran disk utility, and it seems that ALL the files on the system got error unexpected 'ACL '.  By clicking 'Fix' did nothing to solve the problem.

  Displaying information about any file showed several redundant entries sharing and permissions, WHICH are set to = read-only privilege.

  I tried to delete or modify privileges manually, but I'm not able to modify privileges even after my admin id and password.

  I tried to use the terminal to remove the ACL (all 10.10), but who have not (I can't get the correct syntax).

  I thought that the problem probably occurred when I was in the score of Lion, then tried to restart in Lion and Lion is now completely locked as well.  Reboot is stuck on the gray screen with the small wheel (3 days).

  Then I tried to restart in Yosemite, and he is so stuck on the gray screen and the spinning wheel.

  I would try to remove the ACL again using Terminal Server after restarting in the score of 10.10 recovery, but need help with the syntax for the elimination of the ACL in the partition.

  i.e.

  The Yosemite drive name is "HD iMac 27.

  After the launch of Terminal I would enter orders

  1. CD /volumes/ "HD iMac 27.
  2. chmod n r "HD iMac 27.

  This will remove the ACL settings for all files on the partition successfully?

  I enclose a link to a screenshot of 'ls - el' and 'ls - al' orders on the partition, if it can help to diagnosis:

  https://www.dropbox.com/SC/lzrlmb4ttmq9gux/AADR8wsWQNqFoOtF8elTJZUva

  Any help, suggestions or precautions would be greatly appreciated

  TIA

  BTW - as a last resort, I tried to reinstall the Yosemite, but Setup won't work either.  I hope that if I can remove the ACL I can complete the reinstallation.

  Yes, something to add a bunch of ACL permissions where they shouldn't be. This:

  sudo chmod-r n "/ Volumes/iMac 27 inch HD.

  should remove them.

  C.

• LRT224 DMZ ACL

  Hello

  I have a bit of a strange situation that I can't actually know. It's probably something I'm on, that I'm usually on enterprise-class

  My current situation:

  1. WAN1 with an external static IP address.
  2. LAN1 switches in pool addressing of class a.
  3. DMZ connected to the addressing of class B pool (/ 29 subnet)

  Port forwarding pushes some ports to our Exchange/Intranet site on class A.

  Port translation pushes a TCP port that is customized to a specific machine in class B.

  Class B cannot access class A, the opposite is not true. This is normal.

  Class can access the internet, a specific class B machine cannot. This is false.

  How I configure my ACL:

  DENY all traffic to DMZ port. subnet class B source, destination one subnet of class.

  ALLOW all traffic on the DMZ, source ANY, internet destination port.

  ALLOW all traffic on port WAN1, subnet of class B source, destination ANY,

  ALLOW TCP port custom port WAN1, source ANY, a specific destination IP address in the class B (DMZ).

  ALLOW all traffic on the LAN, ANY source, ANY destination port.

  DENY all traffic on the DMZ port, source ANY, a class of destination subnet.

  Furthermore, and I noticed in fact just that, why it's split between WAN and WAN1? Could be the problem?

  As I know the DMZ does not work the way you use. Isn't the range of private IP addresses to public IP addresses for your servers to use instead of a range of IP addresses. The DMZ LRT is different from other standard model of the DMZ.

  https://community.Linksys.com/T5/Linksys-small-business/LRT214-LRT224-DMZ-basic-configuration/m-p/85...