topic Re: Help with ACL on 5308 Switch in Switches, Hubs, and Modems

Help with ACL on 5308 Switch

A Sidoti — Wed, 27 Aug 2008 00:29:34 GMT

Hi,

I have read many threads here relating to ACL and I need some clarification. I have attached a text file showing the ACL 101, how the ACL is applied to Vlan30 and finally the output from a Syslog dump. My questions are,

Is it true that this switch is 'Stateless' when it comes to using ACL?

If so then am I correct in that the Syslog output shows that return traffic is not getting 'out' from the Vlan that I have applied it to?
Do I need to add another ACL like "access-list 50 permit any" and applied to Vlan30 with the filter for 'out' i.e, ip access-group 50 out

Have I gone about this the right way? I am happy to have any feedback on how to do this better.

Many thanks in advance

Re: Help with ACL on 5308 Switch

cenk sasmaztin — Wed, 27 Aug 2008 20:01:18 GMT

hi
what you can want make whit acl 101 on vlan 30

Re: Help with ACL on 5308 Switch

Jarret Workman — Wed, 27 Aug 2008 21:31:53 GMT

Hello A Sidoti,

Looking at the ACL, there is not a permit statement for 10.100.30.0 and the ACL is applied inbound on vlan 30. As a result, the implicit deny any any at the end of the ACL is blocking 10.100.30.0 traffic.

When I think about inbound versus outbound, I look at it as if I am standing inside the switch. So in this case, your ACL is applied inbound on vlan 30 and is blocking any traffic coming in on the ports configured in vlan 30.

Depending on your end goal, it should be simple enough to just add a line to your existing ACL to permit ip 10.100.30.0 0.0.0.255 0.0.0.0 255.255.255.255.

Hope that helps.

Regards,

Jarret

Re: Help with ACL on 5308 Switch

A Sidoti — Thu, 28 Aug 2008 01:34:07 GMT

Hi,

Thanks for the reply. I will change the ACL to add the network 10.100.30.0/24. I will let you know how it goes tonight.