What I'm trying to achieve is as follows:

  • Allow full access to the device on 10.58.9.32 (our VoIP server), from anywhere on our network.
  • Allow ICMP to flow in all directions to/from any device.
  • Prevent all other devices on 10.58.9.0/24 from communicating beyond the VLAN they are on.

To attempt to achieve this, I have created the following ACL on our core switch:

access-list voip permit ip 10.58.9.32 255.255.255.255 0.0.0.0 0.0.0.0
access-list voip permit ip 0.0.0.0 0.0.0.0 10.58.9.32 255.255.255.255
access-list voip permit icmp any any

Whilst I don't have an explicit deny rule, the 6224F processes rules in order and stops when it finds a match, if no match is found, an implied deny rule takes effect.

Subnet 10.58.9.0/24 is associated with VLAN 9, so I've applied the ACL to the VLAN interface as follows:

interface vlan 9
ip access-group voip in 1

VLAN 9 is routed via the core switch, and before I applied the ACL, any device on the entire network could communicate with any devices on VLAN 9 without restriction.

Having applied the ACL to the network, when I then try to connect from my desktop PC via SSH to 10.58.9.32, I can no longer establish a connection. Surely the first two rules would match for the SSH traffic flowing between the two and allow traffic to flow?

I've proven that the ACL is responsible, because when I remove it, I can once again SSH into the server.

Edit

I've got this working, by changing the access list to read as follows:

access-list voip permit ip 10.58.9.32 255.255.255.255 any
access-list voip permit ip any 10.58.9.32 255.255.255.255
access-list voip permit icmp any any

I would have thought that any and 0.0.0.0 0.0.0.0 where identical, clearly not. Does any one know why this is the case?

  • 1
    The whole layer 3 functionality in the 6200-series is a bit dodgy. They're cheap switches and have worked well for me, but you definitely get what you pay for. – Evan Anderson May 14 '11 at 16:46
  • Thanks Evan. I knew this when I bought them, but with budgets being tight, £5k on Dell switches or £50k on Cisco switches was a question I didn't need to ask our directors as I already knew what the answer would be! On the whole, (bear in mind these are the first L3 switches I've bought, or configured), I'm very impressed with them, and don't regret opting for the Dell switches, but I have found a few things they are lacking. (PBR for one). – Bryan May 15 '11 at 8:20

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.