allow pc to communicate only with 1 pc in subnet

Started by mercy_angel, May 10, 2021, 06:03:48 AM

Previous topic - Next topic
Print
Go Down Pages 1 2 3 4
User actions

mercy_angel

#45
June 11, 2021, 02:42:54 AM
device is connected to L2 switch, i cant apply acl there, and this VLAN is trunked through L3

deanwebb

#46
June 14, 2021, 01:57:25 PM
That may be so, but we don't generally put ACLs on trunk ports.

What is the L2 switch and what is it licensed for?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mercy_angel

#47
June 15, 2021, 09:55:19 AM
Quote from: deanwebb on June 14, 2021, 01:57:25 PM
That may be so, but we don't generally put ACLs on trunk ports.

What is the L2 switch and what is it licensed for?

its sg220 cisco and its used for the wall jacks across offices.
We have several ones through the building.

so firewall is creating dhcp, cisco 3750 is holding vlans and ips on it which helper ip is firewall, and from there goes to access switches (sg220).

deanwebb

#48
June 15, 2021, 02:40:30 PM
OK, then it's clear. If you want an ACL to work, it needs to be on a VLAN and the endpoint you want to control needs to be in a separate VLAN from the devices you want to control access to. Call it the "control VLAN" or whatever you want, but it needs to be separate from the other endpoints. If that was a Catalyst switch on the access layer, you'd have ACLs on the port. With the SG series, you secure it with a different VLAN.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mercy_angel

#49
June 16, 2021, 01:25:25 PM
Quote from: deanwebb on June 15, 2021, 02:40:30 PM
OK, then it's clear. If you want an ACL to work, it needs to be on a VLAN and the endpoint you want to control needs to be in a separate VLAN from the devices you want to control access to. Call it the "control VLAN" or whatever you want, but it needs to be separate from the other endpoints. If that was a Catalyst switch on the access layer, you'd have ACLs on the port. With the SG series, you secure it with a different VLAN.

so if i have subnet 192.168.50.0/24 for my devices, i must make 2 vlans with a smaller subnet

vlan50_Other:192.168.50.0/25
vlan50_ITOnly:192.168.50.128/25

you thought like this?

deanwebb

#50
June 16, 2021, 01:32:38 PM
That's one way of doing it.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mercy_angel

#51
June 18, 2021, 04:25:23 AM
Just one more q. Whats about communication betweens 2 VLANs

Code Select
Extended IP access list FILTER_VLAN_25
    10 permit ip any 192.168.2.0 0.0.0.255
    20 deny ip any 192.168.0.0 0.0.128.255 (648975 matches)
    30 permit ip any any (43833968 matches)
    40 permit icmp any any


This VLAN 25 (192.168.25.0/24) can access to VLAN 50. Why?
Its inbound group in VLAN, but why its working access? I want to forbid other VLANs to reach my VLAN50

deanwebb

#52
June 18, 2021, 11:46:31 AM
Well, line 20 is working - you have matches on it - so the question is if you have it applied in both directions, or just one?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mercy_angel

#53
June 18, 2021, 03:40:39 PM
You think on vlan50?Or you think of access grouo out, cause i have only inbound
When i put on vlan 50, i cant access them, but idea is that only vlan50 see all others

deanwebb

#54
June 18, 2021, 05:26:00 PM
Put the restrictions on the restricted VLAN, in and out.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mercy_angel

#55
June 18, 2021, 05:30:25 PM Last Edit: June 20, 2021, 08:28:10 AM by mercy_angel
Quote from: deanwebb on June 18, 2021, 05:26:00 PM
Put the restrictions on the restricted VLAN, in and out.

if i undestand good, interface vlan must be configured like:
ip access-group FILTER_VLAN_25 in
ip access-group FILTER_VLAN_25 out


Code Select
Extended IP access list FILTER_VLAN_25
    10 permit ip any 192.168.2.0 0.0.0.255
    20 deny ip any 192.168.0.0 0.0.128.255 (648975 matches)
    30 permit ip any any (43833968 matches)
    40 permit icmp any any


Idea is that only vlan 50 (192.168.50.0/24) see all those other VLANS, but not vice versa

Update:
When i put this ACL on VLAN25 in and out, i cant access to it from VLAN50.

deanwebb

#56
June 21, 2021, 07:47:43 AM
Honestly, I'd only have the restrictions on the VLAN in question - line 20 should be made to be specific to the /25 we are targeting. I'd have all permit statements for allowed traffic and then a deny all at the bottom for the rest.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mercy_angel

#57
July 03, 2021, 04:44:34 PM
yeah but making those 2 25s are last option, is there no other way?  :'(

icecream-guy

#58
July 04, 2021, 05:57:51 AM
Quote from: mercy_angel on July 03, 2021, 04:44:34 PM
yeah but making those 2 25s are last option, is there no other way?  :'(

host based firewall.
:professorcat:

My Moral Fibers have been cut.
Print
Go Up Pages 1 2 3 4
User actions