topic Re: ACL in Switches, Hubs, and Modems

ACL

Evgeniy Paukov — Thu, 01 Nov 2007 03:44:23 GMT

Good afternoon! It is established HP procurve 2650, two computers A and B. How to adjust ACL list thus what from computer A on computer B there was no access, and with B on A was? Thanks

Re: ACL

OLARU Dan — Thu, 01 Nov 2007 05:53:36 GMT

OK.

2650 has routing capabilities?

If yes,

i1. ip routing
i2. define ip subnets for the vlan interfaces, and assign ipas to these interfaces
i3. put ip acls on the vlan interfaces that have ipa assigned
i4. put the 2 pcs in 2 different vlans/subnets
i4'. make sure the pcs have ipas
i4". check back here if you [still] have any problems

else

i5. no can do

endif

i6. get better @ english

Are you programmer, btw?

Cheers,
Dan

Re: ACL

Evgeniy Paukov — Thu, 01 Nov 2007 06:49:10 GMT

Computers are in different VLAN. The matter is that at creation of a rule for one vlan (A) for example "deny 0.0.0.0 0.0.0.0", from another vlan (A) it is impossible to come in vlan (B), and I need to come. How it is possible to make?

Re: ACL

Matt Hobbs — Thu, 01 Nov 2007 07:10:38 GMT

The 2650 does not support ACLs. This is not possible.

Re: ACL

Evgeniy Paukov — Thu, 01 Nov 2007 07:54:32 GMT

OK.
And on 5304?

Re: ACL

Matt Hobbs — Thu, 01 Nov 2007 08:00:59 GMT

5300 series supports fairly basic ACLs, but if your requirement is so that computer A cannot access computer B, but computer B can access computer A - then you need support the 'established' command in the ACL's. Only the newer 5400/3500 products support this feature along with many other more advanced ACL options.

'established' looks for new TCP connections so it can determine the direction of where the connection is coming from.

Re: ACL

Evgeniy Paukov — Thu, 01 Nov 2007 08:05:39 GMT

What can you advise as to act to me?

Re: ACL

Evgeniy Paukov — Thu, 01 Nov 2007 08:07:46 GMT

And 5304 will support given type ACL?

Re: ACL

Mohieddin Kharnoub — Fri, 02 Nov 2007 11:09:05 GMT

Hi

If you can manage a 3500/5400 then i'm with Matt's suggestion.

Otherwise, with the 5300 you can do it like this:

- Create a Vlan for PC-A with a proper IP address.
- Create another Vlan for PC-B with a proper IP address
- Enable IP Routing on the 5300.
- Now PC-A can talk to PC-B and vise versa
- Apply an ACL allows PC-A Vlan to talk to PC-B Vlan.
- Apply an ACL denies PC-B Vlan to talk to PC-A Vlan.

I think in that way you can achieve your goal.

Good Luck !!!

Re: ACL

Evgeniy Paukov — Wed, 07 Nov 2007 01:11:24 GMT

Thanks.
I shall try and I shall write here Ð¿Ð¾Ð»Ñ Ñ Ð¸Ð»Ð¾Ñ Ñ or not