Thanks again.
Original Message:
Sent: Nov 05, 2024 07:51 AM
From: parnassus
Subject: 3810M standard ACL on static port not working
Hi!
"I don't think I applied it to a vlan though." you're right, I wrongly read the ACL application to interface believing it was applied to VLAN 1, sorry.
So you applied the ACL to the (in)coming traffic traversing the physical interface 1/35 to its destination (and so here we are speaking about a RACL, I suppose) but...I ask you...does the "(in)coming" here mean "from the Switch outgoing through that interface" or the contrary?
"My goal is to only allow traffic from vlan 1 and vlan 3 (10.3.7.0/25) to that port."
So your goal is to filter (permit/drop) traffic incoming from VLAN 1 and VLAN 3 with destination that physical interface 1/35...what is the IP address of the destination device connected to that physical interface? I feel the DST should be specified in ACE rules as the permitted destination (as a.b.c.d Host with 0.0.0.0 wildcard mask).
Something like (permit SRC net -> DST host):
10 permit 10.0.0.0 0.0.3.255 a.b.c.d 0.0.0.0
20 permit 10.3.7.0 0.0.0.127 a.b.c.d 0.0.0.0
VLAN 1 = 10.0.0.0/22 0.0.3.255 subnet = 10.0.0.1 - 10.0.3.254 usable IP addresses range
VLAN 3 = 10.3.7.0/25 0.0.0.127 subnet = 10.3.7.1 - 10.3.7.126 usable IP addresses range
Supposing the a.b.c.d Host is residing on a different VLAN maybe you can transform/adapt the ACL by apply it (or, better, by applying them...you'll need more than one of it) on sources VLAN you want to permit to communicate with the a.b.c.d Host residing on the VLAN Id "x", denying all the others VLAN (so, since those ACLs should be applied where the traffic exactly generates and not far from there, you need an ACL for each VLAN you want to permit/to deny communication to that particular a.b.c.d Host, this no matter the physical interface the Host is really connected to on the Switch).
Original Message:
Sent: Nov 04, 2024 05:48 PM
From: desong1011
Subject: 3810M standard ACL on static port not working
Hi Parnassus,
Thanks for the prompt feedback.
I followed the Aruba documentation here at Aruba 3810 / 5400R Access Security Guide for ArubaOS-Switch 16.09 - Creating ACLs and used the cmd : interface 1/35 ip access-group TEST in in the configuration mode.
I don't think I applied it to a vlan though. My goal is to only allow traffic from vlan 1 and vlan 3 (10.3.7.0/25) to that port.
Original Message:
Sent: Nov 04, 2024 04:27 PM
From: parnassus
Subject: 3810M standard ACL on static port not working
Hi! you wrote that you want to apply the ACL to a switch static port, the interface 1/35 (thus dealing with a Static Port ACL, that is an ACL configured on a port to filter traffic entering the switch on that port, regardless of whether the traffic is routed, switched or addressed to a destination on the switch itself) but then, as far as I understand, you applied the ACL to VLAN 1 in the (in)gress direction...transforming the desired Static Port ACL into a VLAN ACL and this is impacting the way you should design the various ACL's ACEs (in case of a VACL the permit/deny ACEs, if I'm not mistaken, should be defined using source addresses - net or host - belonging to the VLAN's network segment, in your case the VLAN 1 network segment...and destination addresses - net or host - as destinations to which traffic could be routed through the VLAN SVI, traffic seen coming from within your VLAN 1 and destined to any other possible reacheable destination).