- Community Home
- >
- Networking
- >
- Switching and Routing
- >
- Comware Based
- >
- Re: ACL help required (certain ports in VLAN host)
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-26-2020 05:25 AM - edited тАО05-26-2020 09:56 PM
тАО05-26-2020 05:25 AM - edited тАО05-26-2020 09:56 PM
I really need a bit of help with something that should be so easy
- Clients need to be able to obtain ip from dhcp on another Vlan & resolve dns
- Not be able to access any other Vlan & no other Vlan to access it
- Access the internet over ports 80,443 routed in different Vlan 5
- Be able to access certain TCP ports in various clients in same vlan 25 from host in the same Vlan 25
Vlan 25 (one of of few on HPE5900)
I have few clients in this Vlan 25 with one server device, clients need to be accessed by the server on TCP port 10001 (each client has this port opened)
All I need is this Vlan to be fully isolated from other Vlans
With no ACLs applied to this Vlan 25, it is fully accessible (due to inter-vlan routing), which is not ideal, but server can access all clients
But if I apply the below ACL OUTBOUND then server cannot access the clients (which is odd because thay all exist only in same Vlan, hence the traffic is not leaving this Vlan)
With same ACL client obtainds IP from DHCP server just fine
#
interface Vlan-interface25
dhcp select relay
dhcp relay server-address 10.10.9.21
#
acl number 3025 name "Access Control VLAN restrictions"
rule 0 permit udp source 10.10.25.0 0.0.0.255 destination-port range bootps bootpc
rule 0 comment "Allow DHCP requests"
rule 5 permit udp source 10.10.25.0 0.0.0.255 destination-port eq dns
rule 5 comment "Allow DNS queries"
rule 10 permit tcp source 10.10.25.0 0.0.0.255 destination 10.10.5.0 0.0.0.15 counting
rule 10 comment "Allow access to firewall routed link VLAN"
rule 15 permit tcp source 10.10.25.0 0.0.0.255 destination-port range www 443 counting
rule 16 permit tcp source 10.10.25.0 0.0.0.255 destination-port eq 10001
rule 20 deny ip counting
It is kind of simmilar to this question (that was abandoned)
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-26-2020 06:33 AM - edited тАО05-26-2020 06:36 AM
тАО05-26-2020 06:33 AM - edited тАО05-26-2020 06:36 AM
Re: ACL help required (certain ports in VLAN host)
Hello spgsitsupport,
You may want to block the traffic to your internal networks from vlan 25 and allow the other traffic. This way you can enable the internet and separate the vlan from internal traffic. Also it is important if this is inbound direction - it is easier if you control the inbound - towards the switch traffic from the hosts from this vlan.
Hope this helps.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-26-2020 09:41 PM - edited тАО05-27-2020 12:51 AM
тАО05-26-2020 09:41 PM - edited тАО05-27-2020 12:51 AM
SolutionMy outbound ACL was fine for what I need, I was just "bitten" by default behaviour of "the applied ACL does not only filter the inter-vlan routed traffic (as would be expected), but it is applied to intra-vlan switched traffic as well by default" as per this
Ofcourse I do not need the compliucation of switched traffic being ACL-ed, so just adjusted the bahaviour for this VLAN to
# Configure packet filter for routed traffic only
[HP-Vlan-interface25] packet-filter filter route
Seb
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-27-2020 03:37 AM
тАО05-27-2020 03:37 AM
Re: ACL help required (certain ports in VLAN host)
Hello spgsitsupport,
Thank you for sharing this! I am glad you resolved it.
This feature was made years ago and in many models the default is ""route all" as you mentioned. on vlan interface.