HPE Community
HPE Aruba Networking & ProVision-based
1830207 Members
2129 Online
109999 Solutions
New Discussion

Access Control Rule should be simple...

 
NetDudeSSM
New Member

‎02-06-2019 11:08 AM - edited ‎02-06-2019 11:09 AM

‎02-06-2019 11:08 AM - edited ‎02-06-2019 11:09 AM

Access Control Rule should be simple...

Hey everyone. Trying to create a guest network below 172.16.100.0 that can ping, and connect http/ssl to our datacenter, but no other ports. Ping/ICMP works fine, but I can't connect to any websites. DNS resolution is fine as well... If I remove the 10 deny rule, http/ssl works fine of course.  Just doesn't make sense why ICMP works but web browsing doesn't? Thanks for any help! This is a 2920 switch

 

ip access-list extended "STD_ACCESS_IN"
4 permit icmp 172.16.100.0 0.0.1.255 10.10.0.0 0.255.255.255
5 permit tcp 172.16.100.0 0.0.1.255 eq 80 10.10.0.0 0.255.255.255 eq 80
7 permit tcp 172.16.100.0 0.0.1.255 eq 443 10.10.0.0 0.255.255.255 eq 443
10 deny ip 172.16.100.0 0.0.1.255 10.10.0.0 0.255.255.255
30 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit

0 Kudos
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.