A5800 and ACLs

[L1nklight]

I am relatively new to ACLs on this switch module and I was hoping someone could help me understand what I have to do to apply an ACL to a pair of VLANs.

Currently I have a internally designated VLAN and a dmz designated VLAN and traffic is permitted to pass between them. I would like to stop this behavior with the exception of a few ports/protocols, but for now a simple block all will be sufficient. 

My internally desginated vlan is 192.168.1.0 and my dmz desginated VLAN is 192.168.2.0. Both are 24 bit subnets. 

I've created the following acl:

acl number 3000
 rule 0 deny ip source 192.168.1.0 0 destination 192.168.2.0 0

Now, according to some of the documentation I've read I have to do something with traffic classifier? Is this correct? Any info on what my next step should be would be awesome. Thanks in advance. 

[L1nklight]

Ok so I setup some tests and I got working what I need to work. This was accomplished by the following procedure:

acl number 3000
 rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
#
interface GigabitEthernet1/0/1
 packet-filter 3000 inbound
 packet filter 3000 outbound

 Now I want to make some rules for specific hosts with specific tcp ports. Is there a way to combine tcp ports into one? For example if I want to allow 80 and 443 to host 192.168.2.5, what would the rule look like?

acl number 3000
 rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
 rule 1 permit tcp source 192.168.2.4 0.0.0.0 destination 192.168.2.5 0.0.0.0 destination-port eq 80,443

[GrahamB154]

I'm not sure about combining multiple ports into one statement, remember you can simply add a separate rule with the new destination port below the first.

In your example however, I believe this won't work because the ACL is applied based on rule number. So it will apply rule 0 first - Denying everything, and dropping the traffic. You need the most specific statements at the top of the ACL and the 'catch all' ones at the bottom. The explicit deny should usually be at the bottom of the ACL rules set.

Make rule 0 equal to rule 20, and specify the others to start with rule 5.. 10 etc. If you leave spaces then it makes it easier to modify the ACL later on.

Cheers,

Graham

[Michael A. McKenney]

ACLs are usually one to one.   Usually you do your deny rules first and then the last rule is a implicit permit to allow any traffic not covered under deny rules as allowed.   I would not try to combine port rules together in one rule.  I would have separate rules for each so you can analyze traffic problems easier.