|
|
|
Question : access list on core switch for restricted guest access
|
|
|
|
im having a problem understanding how this access list i have applied to vlan 997 and 999 is prohibiting access to my corporate network from the guest network (GuestWireless
, PhysicianAccess). i have listed my running config from my core switch. i am running 3 cisco wireless lan controllers that are connected to this switch via etherchannel. I can however access my guest network from my other vlans (which is fine). I would really appreciate someone helping me understand how this works. Thanks for your responses.
Current configuration : 12597 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
hostname BigBoy
!
!
no aaa new-model
clock timezone CST -6
clock summer-time CST recurring
switch 1 provision ws-c3750g-12s
switch 2 provision ws-c3750g-12s
switch 3 provision ws-c3750g-12s
system mtu routing 1500
ip subnet-zero
ip routing
no ip domain-lookup
ip dhcp excluded-address 172.20.142.1 172.20.142.50
ip dhcp excluded-address 172.20.108.1 172.20.108.50
ip dhcp excluded-address 172.20.106.1 172.20.106.50
ip dhcp excluded-address 172.20.104.1 172.20.104.50
ip dhcp excluded-address 172.20.118.1 172.20.118.50
ip dhcp excluded-address 172.20.136.1 172.20.136.50
ip dhcp excluded-address 172.20.138.1 172.20.138.50
ip dhcp excluded-address 172.20.102.1 172.20.102.50
ip dhcp excluded-address 172.20.140.1 172.20.140.50
ip dhcp excluded-address 172.20.116.1 172.20.116.50
ip dhcp excluded-address 172.20.124.1 172.20.124.50
ip dhcp excluded-address 172.20.114.1 172.20.114.50
ip dhcp excluded-address 172.20.122.1 172.20.122.50
ip dhcp excluded-address 172.21.0.1 172.21.253.255
!
ip dhcp pool MAIN3rdFloor
network 172.20.142.0 255.255.254.0
default-router 172.20.142.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Nursing8th
network 172.20.108.0 255.255.254.0
default-router 172.20.108.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool ICU6th
network 172.20.106.0 255.255.254.0
default-router 172.20.106.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Nursing4th
network 172.20.104.0 255.255.254.0
default-router 172.20.104.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Surgery3rd
network 172.20.118.0 255.255.254.0
default-router 172.20.118.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool WCNorth3rd
network 172.20.136.0 255.255.254.0
default-router 172.20.136.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool WCSouth3rd
network 172.20.138.0 255.255.254.0
default-router 172.20.138.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Lab2nd
network 172.20.102.0 255.255.254.0
default-router 172.20.102.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Radiology2nd
network 172.20.140.0 255.255.254.0
default-router 172.20.140.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool RadiationOncalogy2nd
network 172.20.116.0 255.255.254.0
default-router 172.20.116.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Purchasing1st
network 172.20.124.0 255.255.254.0
default-router 172.20.124.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool Auditorium1st
network 172.20.114.0 255.255.254.0
default-router 172.20.114.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool GuestWireless
network 10.220.0.0 255.255.255.0
default-router 10.220.0.1
domain-name guest.net
dns-server 204.153.217.68 204.153.217.69
!
ip dhcp pool CORPDATA
network 172.21.0.0 255.255.0.0
default-router 172.21.1.1
dns-server 172.20.45.121 172.20.45.122
netbios-name-server 172.20.45.121 172.20.45.122
domain-name butta.org
!
ip dhcp pool ProfessionalBuilding1
network 172.20.122.0 255.255.254.0
default-router 172.20.122.1
domain-name butta.org
dns-server 172.20.45.122 172.20.45.121
!
ip dhcp pool PhysiciansAccess
network 10.220.10.0 255.255.255.0
dns-server 204.153.217.68 204.153.217.69
domain-name rmc-physician.local
default-router 10.220.10.1
!
!
!
!
port-channel load-balance src-dst-ip
no file verify auto
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface Port-channel1
description Connection to Nortel Passport 8010 Core
switchport access vlan 160
!
interface Port-channel2
description Connection to WLC #1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
!
interface Port-channel3
description Connection to WLC #2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
!
interface Port-channel4
description Connection to WLC# 3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
!
interface GigabitEthernet1/0/1
switchport access vlan 160
channel-group 1 mode on
!
interface GigabitEthernet1/0/2
description Connection to WLC #1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 2 mode on
!
interface GigabitEthernet1/0/3
description Connection to WLC# 2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 3 mode on
!
interface GigabitEthernet1/0/4
description Connection to WLC# 3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 4 mode on
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
description Connection to WLC #1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 2 mode on
!
interface GigabitEthernet1/0/7
description Connection to WLC# 2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 3 mode on
!
interface GigabitEthernet1/0/8
description Connection to WLC# 3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 4 mode on
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
switchport access vlan 160
channel-group 1 mode on
!
interface GigabitEthernet2/0/1
switchport access vlan 160
channel-group 1 mode on
!
interface GigabitEthernet2/0/2
description Connection to WLC #1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 2 mode on
!
interface GigabitEthernet2/0/3
description Connection to WLC# 2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 3 mode on
!
interface GigabitEthernet2/0/4
description Connection to WLC# 3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 4 mode on
!
interface GigabitEthernet2/0/5
!
interface GigabitEthernet2/0/6
description Connection to WLC #1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 2 mode on
!
interface GigabitEthernet2/0/7
description Connection to WLC# 2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 3 mode on
!
interface GigabitEthernet2/0/8
description Connection to WLC# 3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 160,997-999
switchport mode trunk
channel-group 4 mode on
!
interface GigabitEthernet2/0/9
!
interface GigabitEthernet2/0/10
!
interface GigabitEthernet2/0/11
!
interface GigabitEthernet2/0/12
switchport access vlan 160
channel-group 1 mode on
!
interface GigabitEthernet3/0/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 104,160
switchport mode trunk
!
interface GigabitEthernet3/0/2
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 106,160
switchport mode trunk
!
interface GigabitEthernet3/0/3
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 108,160
switchport mode trunk
!
interface GigabitEthernet3/0/4
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 114,160
switchport mode trunk
!
interface GigabitEthernet3/0/5
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 124,160
switchport mode trunk
!
interface GigabitEthernet3/0/6
description Professional Plaza
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 122,160
switchport mode trunk
!
interface GigabitEthernet3/0/7
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 140,160
switchport mode trunk
!
interface GigabitEthernet3/0/8
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 102,160
switchport mode trunk
!
interface GigabitEthernet3/0/9
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 138,160
switchport mode trunk
!
interface GigabitEthernet3/0/10
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 136,160
switchport mode trunk
!
interface GigabitEthernet3/0/11
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 118,160
switchport mode trunk
!
interface GigabitEthernet3/0/12
switchport trunk encapsulation dot1q
switchport trunk native vlan 160
switchport trunk allowed vlan 142,160
switchport mode trunk
!
interface Vlan1
no ip address
shutdown
!
interface Vlan102
ip address 172.10.102.1 255.255.254.0 secondary
ip address 172.20.102.1 255.255.254.0
!
interface Vlan104
ip address 172.10.104.1 255.255.254.0 secondary
ip address 172.20.104.1 255.255.254.0
!
interface Vlan106
ip address 172.10.106.1 255.255.254.0 secondary
ip address 172.20.106.1 255.255.254.0
!
interface Vlan108
ip address 172.10.108.1 255.255.254.0 secondary
ip address 172.20.108.1 255.255.254.0
!
interface Vlan114
ip address 172.20.114.1 255.255.254.0
!
interface Vlan118
ip address 172.10.118.1 255.255.254.0 secondary
ip address 172.20.118.1 255.255.254.0
!
interface Vlan122
ip address 172.10.122.1 255.255.254.0 secondary
ip address 172.20.122.1 255.255.254.0
!
interface Vlan124
ip address 172.10.124.1 255.255.254.0 secondary
ip address 172.20.124.1 255.255.254.0
!
interface Vlan136
ip address 172.10.136.1 255.255.254.0 secondary
ip address 172.20.136.1 255.255.254.0
!
interface Vlan138
ip address 172.10.138.1 255.255.254.0 secondary
ip address 172.20.138.1 255.255.254.0
!
interface Vlan140
ip address 172.10.140.1 255.255.254.0 secondary
ip address 172.20.140.1 255.255.254.0
!
interface Vlan142
ip address 172.20.142.1 255.255.254.0
!
interface Vlan160
ip address 172.20.160.2 255.255.254.0
!
interface Vlan997
ip address 10.220.10.1 255.255.255.0
!
interface Vlan998
ip address 172.21.1.1 255.255.0.0
!
interface Vlan999
ip address 10.220.0.1 255.255.255.0
ip access-group GuestWireless in
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.20.160.1
ip http server
!
ip access-list extended GuestWireless
deny udp any 10.0.0.0 0.255.255.255 eq domain
deny udp any 172.16.0.0 0.15.255.255 eq domain
deny udp any 192.168.0.0 0.0.255.255 eq domain
permit udp any any eq domain
permit udp any any eq bootpc
permit udp any host 10.220.0.1 eq bootps
deny ip any 10.0.0.0 0.255.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 172.16.0.0 0.15.255.255
permit ip any any
ip access-list extended Physicians
deny udp any 10.0.0.0 0.255.255.255 eq domain
deny udp any 172.16.0.0 0.15.255.255 eq domain
deny udp any 192.168.0.0 0.0.255.255 eq domain
permit udp any any eq domain
permit udp any any eq bootpc
permit udp any host 10.220.10.1 eq bootps
deny ip any 10.0.0.0 0.255.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 172.16.0.0 0.15.255.255
permit ip any any
!
tftp-server 172.20.23.110
!
control-plane
!
!
line con 0
logging synchronous
line vty 0 4
password
logging synchronous
login local
length 0
line vty 5
password
login local
line vty 6 15
password
login
!
ntp server 172.20.44.18 key 0 prefer
end
|
|
|
|
Answer : access list on core switch for restricted guest access
|
|
Ok so here goes. First of all there is no acl being applied on vlan 997 so I will deal only with 999
interface Vlan999
ip address 10.220.0.1 255.255.255.0
ip access-group GuestWireless in
!
ip access-list extended GuestWireless
deny udp any 10.0.0.0 0.255.255.255 eq domain
deny udp any 172.16.0.0 0.15.255.255 eq domain
deny udp any 192.168.0.0 0.0.255.255 eq domain
permit udp any any eq domain
permit udp any any eq bootpc
permit udp any host 10.220.0.1 eq bootps
deny ip any 10.0.0.0 0.255.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 172.16.0.0 0.15.255.255
permit ip any any
so the basics of each command is permit / deny and either tcp/udp/ip then the source ip address/network followed by the destination ip address/network and then possibly the specific tcp/udp port.
so if we look at the first line:
deny udp any 10.0.0.0 0.255.255.255 eq domain
We will deny any source ip address that is destined for the 10.x.x.x network using udp port 53 (dns lookups)
You also need to keep in mind how the access-list is applied.. in or out. your acl is applied inbound, meaning traffic heading into the interface vlan 999. So this would be traffic that was generated on that vlan heading into the layer vlan 999 in order to get out somewhere else...
So your second line does the same thing, except blocks anything from getting to the 172.16.x.x networks and the 3rd line the same thing except blocks the 192.168.x.x networks. Then after that we let you do dns queries to anything.
The order of the acl is important. The first line we match is the action we will take. So first we block traffic from doing dns queries to our internal network then we allow all other dns queries to work so this is most likely to an external dns server on the internet.
Then we allow bootp which is basically allowing dhcp to function.
Then we block any traffic coming in to the layer 3 interface of vlan 999 from reaching the same 3 networks that were blocked previously on anything using IP.
Then we allow it to get to everything else.
So basically the flow is block what we don't want then open up what else remains, which should be anything on the internet.
I hope that helps.
|
|
|
|
|
