Question S4048-on ACL

Similar Questions

• Questions of the ACL.

  Howdy,

  I am familiar with the use of ASA and catch running attribute errors so I though I would ask experts.

  I have several older (ish) routers that have ACLs on them I want to transfer to the new ASA 5510 from the outside, but I think this isn't as simple as cut and paste. For example.

  When I use "established" in a new ACL it has no idea of what I type. It is no longer used?

  Also in use in my current ACL line would look like this

  Access-list 103 permit udp any 38.100.32.0 0.0.0.255 eq field

  But when I type in my new 5510 I get an error that my IP address and the subnet mask is not pair. (I get the same error when I cut my old ACL in a text editor and then try to paste in my ASA 5510. What I am doing wrong?

  If anyone can point in the right direction, I would be very grateful. (with several ACL have to be routed via I'm afraid how it is is no longer used or different.)

  Thank you

  No problem. glad to be of assistance.

• ACL VPN question

  I have two questions that regarding ACL is used in the instructions on the Card Crypto:

  1. the two devices VPN should have the same ACE in the ACL? I know that without the second ACE site B below will not see as interesting udp traffic, but the will of the vpn tunnel fails because the ACL is not the same ACE?

  That is to say...

  Site has

  Access-list 110 permit tcp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

  Access-list 110 permit udp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

  Site B

  Access-list 110 permit tcp 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0

  2. once a tunnel is established it will send ANY/ALL traffic destined to the remote network through this tunnel. If the first ACE in the ACL 110 to Site A list is used to bring up the tunnel, only tcp from to 10.0.2.0/24 10.0.1.0/24 traffic will use the tunnel or all traffic from 10.0.1.0/24 intended for the remote network to cross the tunnel?

  I guess my thought is this. The ACL is only used to determine valuable traffic and once the tunnel is up it is a free for all. Or the ACL only allows traffic that meets the criteria specified in the ACL list to flow once the tunnel is established?

  Thank you

  Brian

  Brian,

  Your statement

  'Or the ACL allows only traffic that meets the criteria specified in the ACL list to flow after the tunnel is established'

  Is correct, only the traffic that meets the ACL crypto will go through the vpn tunnel and all other traffic will be denied. If you need UDP traffic to travel through the tunnel, you need crypto ACL on both sides and not only on one side, that is, SITE A.

  Hope this helps,

  Jay

• Switchport edge ACL, confused

  So my question is an ACL must define access to the gateway of the network.

  Example of ACLs configured on the port of edge on a network of 10.0.0.0/24.

  The network gateway is 10.0.0.1

  The network host is 10.0.0.200

  Host should only have access to tcp/80 on 192.168.1.200

  Would say edge switchport acl:

  Edge_ACL extended IP access list

  permit tcp host 10.0.0.200 host 192.168.1.200 eq www
  deny ip any any newspaper

  Question is what I have to look like this:

  Edge_ACL extended IP access list

  ip licensing 10.0.0.200 host 10.0.0.1

  permit tcp host 10.0.0.200 host 192.168.1.200 eq www
  deny ip any any newspaper

  Thank you

  Chris

  Chris

  You managed to confuse me as well and I just edited my previous answer, because I was wrong.

  You need not allow traffic to the gateway by default because it never is the IP address of the packet destination. If your first acl would work. He could still block all other traffic, including traffic to other hosts 10.0.0.x, but it would allow traffic to the web server.

  When the PC wants to talk about the web server it arps out for the mac of the gateway address (or use it if it's in the arp table), and then sends the packet with a destination IP address of the web server that is allowed in your acl. So no need to add the default gateway to the acl.

  My apologies for the misleading info, sometimes I even with stupid, I can be surprised

  Jon

• ACL router and Switch

  Hello.

  I have a small question.

  I implemented a simple extended ACL.

  ip licensing 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

  refuse an entire ip

  It is enabled on the SVI interface IN direction with ip 10.10.10.1/24.

  When I test with the ping from the router to a network blocked from using the interface (SVI) source ACL does not work.

  Example: ping source 172.16.1.5 10.10.10.1 = success.

  This should not be blocked and only allow traffic to 192.168.1.0/24?

  So my questions. The ACL effect on the interface of the router itself and only other hosts on the subnet / vlan? (I think I remember having read about it, but can't find it)

  Thank you.

  Hi traffic there, navigate the interface so that the ACL to be considered. Here is a link to another thread on the forum that explains this very well:

  https://supportforums.Cisco.com/discussion/12043016/pls-explain-SVI-ACL-source-and-destination-direction

  I hope this helps!

  Thank you for evaluating useful messages!

• Number of ACL by interface

  ACL how can I request an interface? I have a few long ACLs that I want to break up to make it easier to manage. I have 5 incoming ACL applied to my DMZ interface on a 525 running version 6.3 (4)?

  Roland,

  I think your question is if you can have more than one ACL per interface...

  Let's check out some definitions first:

  ACL: Access Control List, it is a union of ACEs that specify if traffic will be allowed/denied on the basis of source and destination

  ACE: What are the specific lines that you add to an ACL

  (i.e..)

  access list 1 TEST line allow tcp a whole

  allowed for TEST access list row 2 udp a whole

  -L'ACL is TEST

  -ACEs are "line 1" and «line 2"»

  1_ so if your question is in what concerns the number of ACEs per ACL by Interface, I will say that you can have as many as you want, but make sure that you use the TURBO ACL function with the 'updated access-list command"

  2_ if your question is how ACLs, you can have by interface, I say it's just a... You bind the ACL to an interface with the access-group command and the rule is "what an acl by interface.

  Please click the link below:

  http://Cisco.com/en/us/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a00800eb721.html#wp1001972

  "You use the access-list and access-group commands to allow access based on source or destination IP address, or the port number of the Protocol. Use the access-list command to create a single access list entry and use the access-group command to bind one or more entries from the access list to a specific interface. Specify only a single command access-group for each interface. »

  I would like to know if this can help, if I was wrong about my assumption give me details and I would be more than happy to help

  Frank

• IPsec tunnel ACLs

  If I create a card encryption there is the address for correspondence control (acl). My question is; This acl sets the only traffic that is allowed in the tunnel or will other types of traffic that are allowed in the tunnel and all simply not encrypted.

  Hi Chris and Daniel,

  All traffic authorized by the crypto acl will be led by the IPSec tunnel.

  The rest of the traffic will not use the tunnel, but is passed by the link.

  "license ip any any" is allowed on crypto as on any other ACL ACL. Its use depends on how you want to define your valuable traffic.

  Cheers:

  István

• ACL interface or subinterface

  I have an ACL that is applied to an interface that contains a subinterface. The interface has no assigned IP address, but is in place. The ACL does not seem to capture all traffic, a sh ip access-list 101 shows no match. I guess my question is, the ACL should apply to the subinterface to be emotional.

  Serial0/0 is up, line protocol is up

  The material is PQUICC with fractional T1 CSU/DSU

  MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec,

  reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation FRAME - RELAY IETF, loopback not set

  Serial0/0.2 is up, line protocol is up

  The material is PQUICC with fractional T1 CSU/DSU

  Description: Address Internet of Verizon Business MPLS Circuit atlanta-ga is x.x.x.x/30

  set the ACL on the subinterface.

• ACL IP and TCP ACL... What is the difference?

  Hello

  I have a few questions on the ACL.

  1. for PIX ACL, let's say I want to host a Web server in the network internally (just to simplify my question), and I do not PAT, but only a static NAT

  public static 202.188.100.1 (Interior, exterior) 10.1.1.1 netmask 255.255.255.0

  acl_out tcp allowed access list all 10.1.1.1 eq 80

  Access-group acl_out in interface outside

  Done the above equivalent to

  public static 202.188.100.1 (Interior, exterior) 10.1.1.1 netmask 255.255.255.0

  ip access list acl_out permit any 10.1.1.1

  Access-group acl_out in interface outside

  2. for IOS ACL, is it possible to block A (10.1.1.0/24) network access to network B (10.1.2.0/24) but to allow access from network B to network A? How can I do?

  Thank you.

  Hello

  1. first of all your ACL is a little bad, you need to enable connections to the public of your devices address and not the private sector when allowing traffic from the outside.

  The answer to your first question is no, if you don't mind the tcp 80 port in your access list then you allow just that, if you allow ip in your access list then you allow all IP protocols based including all TCP ports, UDP and ICMP ports all.

  2. you can do this using either the keyword in your access list or reflexive access lists.

  Network B to an ACL

  ---

  IP 10.1.2.0 allow 0.0.0.255 10.1.1.0 0.0.0.255

  Network from A to B ACL

  ---

  ip licensing 10.1.1.0 0.0.0.255 10.1.2.0 all created 0.0.0.255

  Means that any traffic can pass from network B to network A, however only established connections (packets with the ACK bit value) are admitted from B to A.

  The other method is reflexive-list using access which are with State of access lists. When the traffic moves from one network to the other a dynamic access list is created, traffic is only allowed to enter the network source if a dynamic entry is present in the table with the same source and destination IP information. An access list works in a direct, so from A to B, if you wanted to allow B to talk to A you need to configure specific static access list entries.

  HTH

  PJD

• Subject of LCA in PIX?

  I use version 7.x PIX IOS.

  I have a very basic question about the ACL. As cisco router IOS in each access list it is an implicit deny a whole at the end of the default ACL. Is the same rule apply to the PIX ACL or we write explicitly refuse at the end of the instructions of the ACL?

  Hello

  By default, all access lists have an implicit refusal unless you specify explicitly allowed.

  I hope this helps.

  Glen

• Impossible to get to the beach for additional IP addresses on IPSec Site to Site VPN

  Hello
  I am trying to set up a free IPSec Site to Site VPN between an ASA 5510 (ASA Version 8.2 (3)) to the AC and a Cisco 877 (12.4 (24) T3) to a branch.

  At the end of the branch, I have the 192.168.244.0/24 subnet.
  At the end of HQ, I have the 172.16.0.0/22 and the 10.0.0.0/8 subnets
  The inside interface of the ASA at Headquarters is 172.16.0.15/22

  When installing VPN Wizard I ticked the box NAT - T, and I included the additional subnet in the list of protected LANs.

  I can sucessfully all the subnets 172.16.0.0/22 but not access anything in the 10.0.0.0/8 subnets.
  The Packet Trace ASA tool shows the traffic inside the interface of 172.16.0.0/22 in the direction of 192.168.244.0/24 through the outside interface properly spend, but the 10.0.0.0/8 does not work. He gives no precise information why the 10.0.0.0/8 traffic is dropped.

  [HQ_LAN]---10.0.0.0/8 & 172.16.0.0/22---172.16.0.15(inside_int)-[ASA 5510] - IPSEC-[RTR 877]---192.168.244.0/24---[BRANCH_LAN]

  I suspect it might have something to do with NAT?

  Help, please.

  Hello

  Peer VPN you do not accept the LAN between these two peers of vpn segment.

  On your ASA

  inside_outbound_nat0_acl list of allowed ip extended access all <> 255.255.255.0

  and

  Router:

  access-list 100 permit ip 192.168.244.0 0.0.0.255 172.16.0.0 0.0.3.255

  access-list 100 permit ip 192.168.244.0 0.0.0.255 10.0.0.0 0.255.255.255

  Please make the same statement subnet explicitly between two vpn peers and finally please add this route on SAA.

  Same question on this ACL so, statement of not identical subnet between two peers of vpn, please make sure it identical at both ends.

  outside_cryptomap_2 list extended access allowed object-group ip <> <> 255.255.255.0

  Route outside 192.168.244.0 255.255.255.0 ASA_EXTERNAL_GW

  Let me know the result.

  Thank you

  Rizwan James

• S4048-ON - MLAG Question

  From the world of Cisco, I wanted to put two S4048s in a VSS mode.  Dell touts the MLAG via VLT abilities, but as far as I can tell, it is analogous to the Cisco Nexus VPC.  I'm therefore looking to separate control/management plans.  It is not possible to rethink the VSS as capabilities?  The reason why I ask, is I'm looking for high-times.  If I get only L2 abilities off SUVS, so I run VRRP between switches, but I am concerned about the convergence time.  I have not messed with VRRP a lot, but I was pretty happy with HSRP 2 convergence.  I can foresee periods of weak convergence with VLT + VRRP or should I consider going with a configuration of the stack instead?  Also, I used Cisco enough that I met of numerous warnings "featured".  Any configuration warnings, should I be aware of cases using the VLT or stacking?

  Well, I answered my question after his arrival in the whole of the additional documents (VLT).  What I'm looking for is "peer routing", which denies the necessity of VRRP.  If the two switches will actively transmit packets, instead to pass traffic through the VLTi.  There should not be problems of convergence as a result.  This is similar to Cisco VSS AFAIK, except control plans are separated on the side of Dell.

  I am still confused but problems with devices monoresident; See my post above.  I guess I can lab this place, but it is not clear in a scenario of equal routing, if these devices will be a problem.

• On the basic ACL question

  I have a few question ACL. I'm not clear on the source address and the destination address in the following cases.

  Case 1

  My IP WAN1 is 1.1.1.1, my FTP server is 192.168.1.2 port 23

  If I have access to FTP from internet, use ftp://1.1.1.1:23, so what's my IP ACL of source and destination IP? 1.1.1.1 is source? destination is 192.168.1.2? or any?

  Internet-(Outside 1.1.1.1) ASA (inside 192.168.1.1) - FTP (192.168.1.2)

  Case 2

  My WAN1 is always 1.1.1.1 and FTP is 192.168.1.2 port 23

  If I use the ftp://1.1.1.1:8023internet FTP access, what the ACL source IP address and destination?

  I tested in both cases = any source and destination = everything is OK.

  But I confused. I still think the Source address is IP WAN1.

  Hello

  You access the server FTP from the Internet and most likely, you won't know what ip address you will be source. In this case, your source ip address will be everything. If you know the ip address on the Internet that will have access to your FTP server, and then you specify it as the source. You access list will be as follows:

  access-list extended 100 permit tcp any host 1.1.1.1 eq 21

  access-list extended 100 permit tcp any host 1.1.1.1 eq 20

  or

  access-list extended 100 permit tcp x.x.x.x y.y.y.y host 1.1.1.1 eq 21

  access-list extended 100 permit tcp x.x.x.x y.y.y.y host 1.1.1.1 eq 20

  (if you know the network or host who will have ftp access)

  You must also make sure that you have configured static NAT and inspection of the request to your FTP server

  Thank you

  John

• ASA ACL question

  I'm new to the ASA and try to understand something with ACL. It will take I understand about their creation and by adding entries and that all should have the same name, but I'm confused about the ACLs that do not have the same name that already exist on a device or may be named differently.

  For example:

  Access-List Corporate1 permit tcp any any eq www

  Access-List permits Corporate1 tcp everything any https eq

  Access list ip Inside_Out allow a whole

  Access-group Coprorate1 in interface outside

  Ignoring the content at the moment, I have 2 ACL: one with 2 inputs and one with a single entry. The Corporate1 of the ACL applies within the interface and is active. I get this part... My question is: is the Inside_Out of the grouped ACL in automatically with the ACL and activates them as well active or is it safe to say it is not active and can be removed without causing damage? Is the ACL only activates the ACL with the same name as the Access-Group Corporate1?

  I have 2 different people telling me two different things. I'm lost on this one, any help would be greatly appreciated.

  -Jon

  Working with ACLs imply always two steps:

  1. You configure the ACL (with possibly multiple lines but the same name).
  2. You set the ACL to a function. Which might be filtering on an interface with the control-group-access, but is not limited to the one that the ACL is used in several places when the ASA must match the traffic.

  (If you did both) 1 and 2), then the ACL is active and currently in use. If you have set up the ACL only but the ACL was never assigned to a function, then the ACL is not active and can be removed.

  In your example:

  If you find that the ACL 'Inside_Out' but you don't know if the ACL is used, then do one

   sh run | inc Inside_Out

  If the output shows only the ACL lines, it is unused and can be removed.

   clear configure access-list Inside_Out

  Or it is but not used must be used, and then apply the ACL for the desired purpose.

• Inbound and outbound ACL question

  I want to restrict inbound and outbound traffic with access-lists on my PIX 515. May be this is a stupid question, but I don't know how the acl pix treatment directions of traffic. Let's say that I encouraged in traffic ntp to the outside to the inside host inbound_acl, I need to open port ntp also in the outbound_acl pass the ntp response?

  Is it the same for the other direction (inside origin traffic)?

  Thanks for any response.

  Hello

  If you open port NTP of outside inside the host, PIX will maintain this session state and will return by the hosts inside circulation. The default is no ACL out (ACL equivalent to entering on the inside of the interface). The statefull inspection rule is the same for all directions/interfaces.

  Thank you

  Nadeem