Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a single HP ProCurve 2610 in a remote location that is connected in with the rest of the network via SHDSL. There are two Layer-3 networks on this segment. ACLs are setup to deny one subnet (192.0.2.0/24) from ever being able to leave the switch by virtue of being applied to port attached to the upstream connection. The other subnet should be permitted to freely leave the switch. Both subnets are on the same VLAN.

Unfortunately SFlow very clearly show broadcast traffic from 192.0.2.0/24 on the upstream connection. ProCurve ACLs are not my strong suit but I feel like I'm missing something very simple here.

ip access-list extended "Filter for Camera Network" 
   deny ip 192.0.2.0 0.0.0.255 0.0.0.0 255.255.255.255 log 
   permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 
   exit

interface 24 
   name "DSL - UPLINK" 
   access-group "Filter for Camera Network" in
exit

Unless I am mistaken traffic from 192.0.2.0/24 should be dropped as it crosses the uplink port (int 24) whereas all other traffic will be permited by the following default allow rule.

What exactly am I missing here?

EDIT:

Firstly, why do you have two subnets contained in the same VLAN?

Because that's how it was configured by a previous administrator and while it makes conceptual sense that a single subnet is "mapped" to a single VLAN there's no technical constraint that I am aware of that makes this have to be the case.

Instead of filtering inbound traffic on your uplink, you should be filtering outbound traffic.

The HP2600 series can only filter inbound traffic on interfaces. Should I change my filter to deny any to 192.0.2.0/24?

share|improve this question
1  
No, changing your filter to deny any to 192.0.2.0/24 would block any externally initiated connections to 192.0.2.0/24. In order to block that subnet from getting out of that interface, you need to filter outbound traffic. –  Cheekaleak Jun 27 '12 at 17:17
add comment

3 Answers

Firstly, why do you have two subnets contained in the same VLAN?. Although, that's not your problem here. I can't speak to the syntax of the commands as I haven't configured HP ProCurves, but it seems your logic is off. Instead of filtering inbound traffic on your uplink, you should be filtering outbound traffic. The uplink interface wouldn't receive traffic from that subnet, it would pass traffic through.

share|improve this answer
    
Please see my edit. –  kce Jun 27 '12 at 16:45
add comment

The simple answer is reconfigure the Layer3 device providing routing to NOT have an interface or secondary IP in the subnet that you don't want to leave the switch. If there is no layer 3 route from/to that subnet then traffic will only exist in the layer2 switching environment of the switch for that subnet.

Edit: if it has an uplink to another switch you can filter the subnet on THAT switch inbound.

share|improve this answer
add comment

If you're right about the traffic filters on the 2610 (it's been a while since i've looked at them), then you should be adding this filter on the individual ports which are part of that address range. Filtering traffic on the uplink would only work if the 2610 supports outbound filters.

Presumably you've got a server collecting the camera data on the same VLAN? In that case, you'll probably also need an extra rule in there which allows 192.0.2.0/24 to 192.0.2.0/24, and you probably don't want to apply the ACL to the server port, otherwise you won't be able to access it remotely.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.