Online Expert Day - HPE Data Storage - Live Now
April 24/25 - Online Expert Day - HPE Data Storage - Live Now
Read more
ProCurve / ProVision-Based
cancel
Showing results for 
Search instead for 
Did you mean: 

5406zl Switch Access List

Omer Asik
Occasional Advisor

5406zl Switch Access List

Hi,
I have installed HP Procurve 5406zl 48G switch to my customer. The default VLAN of the switch contains 48 ports and they are being used for Internal private network. The other modelules of the switch contains 65 different VLANs starting from 192.168.10.1/24 to 192.168.75.1/24. My Default_Vlan ip address is 10.37.1.5/16.
I want to prevent my Default_VLAN from the other VLANs. ( from 192.168.10.1/24 to 192.168.75.1/24 ). I know that i can implement this settings throught Access List but i am new on it.
What is the exact Access List command settings for this setup ?
Thank you.

 

P.S. This thread has been moved from Switches, Hubs, Modems (Legacy ITRC forum) to ProCurve / ProVision-Based. -HP Forum Moderator

6 REPLIES
Mohieddin Kharnoub
Honored Contributor

Re: 5406zl Switch Access List

Hi

On the 5400 you can create an ACLs to help you prevent one Vlan from accessing other Vlans.

Now if you notice that you have to prevent 1 Vlan from accessing 65 Vlans, and that means if we want to use Standard ACL then we need 65 of them, so we can use Extended ACL and wild card mask.

5400(config)#ip access-list extended "Vlan1"
deny ip 10.37.1.5 0.0.255.255 192.168.10.1 0.0.127.255 log
permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
5400(config)#vlan 1 ip access-group vlan1 out

The previous Extended ACL will block any traffic with source 10.37.0.0/16 destined to a range of IP addresses between:
192.168.0.0/24 to 192.168.127.255.
and it will allow other Vlan1 traffic destined other that previous range of networks.

After creating the ACL we apply it on Vlan1 (default-vlan) to outbound traffic.

Good Luck !!!


Science for Everyone
Omer Asik
Occasional Advisor

Re: 5406zl Switch Access List

I want to block any ip traffic from 192.168.X.X network to 10.37.1.5. I mean;
My source networks are ;

192.168.10.1
192.168.11.1
.
.
.
.
192.168.75.1

and destination network is 10.37.1.5.
In your answer it will block all ip traffic from 10.37.1.5 to 192.168.X.X network.

Mohieddin Kharnoub
Honored Contributor

Re: 5406zl Switch Access List

Hi

Here you go :)


5400(config)#ip access-list extended "Vlan1"
deny ip 192.168.10.1 0.0.127.255 10.37.1.5 0.0.255.255 log
permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
5400(config)#vlan 1 ip access-group vlan1 in

The previous Extended ACL will block any INCOMING traffic with source between 192.168.0.0/24 to 192.168.127.255 and destined to 10.37.0.0/16 and it will allow other traffic.

Good Luck !!!
Science for Everyone
Matt Hobbs
Honored Contributor

Re: 5406zl Switch Access List

If I'm reading this right, you have two options:

5400(config)#ip access-list extended "Vlan1"
deny ip 192.168.10.1 0.0.127.255 10.37.1.5 0.0.255.255
permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
5400(config)#vlan 1 ip access-group vlan1 out

OR

5400(config)#ip access-list extended "Vlan1"
deny ip 192.168.10.1 0.0.127.255 10.37.1.5 0.0.255.255
permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
5400(config)#vlan 2 ip access-group vlan1 in
5400(config)#vlan 3 ip access-group vlan1 in
5400(config)#vlan 4 ip access-group vlan1 in
etc

Applying ACL's on the 'in' is more efficient.
nawid
Occasional Visitor

Re: 5406zl Switch Access List

Dear All i would like to block Vlan 2 10.140.0.0 255.255.0.0 to vlan 1 10.9.0.0 255.255.255.0

 

I wanted to block user vlan 2 users to access vlan 1

 

hostname "Core-Switch"
ip access-list extended "Block"
exit
ip access-list extended "block"
10 deny ip 0.0.0.0 255.255.255.255 10.140.0.0 255.255.0.0
20 deny ip 0.0.0.0 255.255.255.255 10.9.0.0 255.255.255.0
exit
module 1 type J9537A
ip routing
vlan 1
name "Admin"
untagged A21
ip helper-address 10.9.1.205
ip address 10.9.1.10 255.255.255.0
tagged A1-A19,A23-A24
no untagged A20,A22
ip access-group "block" in
exit
vlan 2
name "HSIA"
untagged A20,A22
tagged A1-A6,A19,A21,A23-A24
no ip address
exit
vlan 100
name "WiFi_MNGT"
untagged A23
ip address 172.16.100.1 255.255.255.0
tagged A1-A6,A19-A21,A24
exit
vlan 140
name "VLAN140"
tagged A1-A6,A19-A24
no ip address
exit
snmp-server community "public" unrestricted
spanning-tree
spanning-tree priority 0 force-version rstp-operation
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

 

please provide me how to do ti

runnow70
Visitor

Re: 5406zl Switch Access List

How can use in and out on the vlan. I'm confused.Let me know.