Content reorganization and cleanup in the Networking category
Based on an audit of all our content here in the Networking category, we are doing "Spring Cleaning."
Find details here
Showing results for 
Search instead for 
Do you mean 

A5800 and ACLs

Valued Contributor

A5800 and ACLs

I am relatively new to ACLs on this switch module and I was hoping someone could help me understand what I have to do to apply an ACL to a pair of VLANs.


Currently I have a internally designated VLAN and a dmz designated VLAN and traffic is permitted to pass between them. I would like to stop this behavior with the exception of a few ports/protocols, but for now a simple block all will be sufficient. 


My internally desginated vlan is and my dmz desginated VLAN is Both are 24 bit subnets. 


I've created the following acl:


acl number 3000
 rule 0 deny ip source 0 destination 0


Now, according to some of the documentation I've read I have to do something with traffic classifier? Is this correct? Any info on what my next step should be would be awesome. Thanks in advance. 

Valued Contributor

Re: A5800 and ACLs

Ok so I setup some tests and I got working what I need to work. This was accomplished by the following procedure:


acl number 3000
 rule 0 deny ip source destination
interface GigabitEthernet1/0/1
 packet-filter 3000 inbound
 packet filter 3000 outbound

 Now I want to make some rules for specific hosts with specific tcp ports. Is there a way to combine tcp ports into one? For example if I want to allow 80 and 443 to host, what would the rule look like?

acl number 3000
 rule 0 deny ip source destination
 rule 1 permit tcp source destination destination-port eq 80,443


Occasional Advisor

Re: A5800 and ACLs

I'm not sure about combining multiple ports into one statement, remember you can simply add a separate rule with the new destination port below the first.


In your example however, I believe this won't work because the ACL is applied based on rule number. So it will apply rule 0 first - Denying everything, and dropping the traffic. You need the most specific statements at the top of the ACL and the 'catch all' ones at the bottom. The explicit deny should usually be at the bottom of the ACL rules set.


Make rule 0 equal to rule 20, and specify the others to start with rule 5.. 10 etc. If you leave spaces then it makes it easier to modify the ACL later on.





Respected Contributor

Re: A5800 and ACLs

ACLs are usually one to one.   Usually you do your deny rules first and then the last rule is a implicit permit to allow any traffic not covered under deny rules as allowed.   I would not try to combine port rules together in one rule.  I would have separate rules for each so you can analyze traffic problems easier.