Basic ACL: Switch says ACL doesn't exist when I created it, please help.

  • 0
  • 1
  • Question
  • Updated 3 years ago
  • Answered
Hi Everyone, 

I'm trying to create and apply a ACL to a vlan on my switch but when I run the commands it says it doesn't exist.

1. I created the policy by entering: vi PBR_DEFAULTROUTE.pol
I enter a simple a entry and entered :wq! to save. successfully.

2. I typed in ls and it is listed under my files.

-rw-rw-rw-    1 root     0             932 May 19 12:39 PBR_DEFAULTROUTE.pol


3. Saved config on switch


4. I entered check policy PBR_DEFAULTROUTE.pol

# check policy PBR_DEFAULTROUTE.pol
Error:  Policy PBR_DEFAULTROUTE.pol does not exist on file 


5. Attempt to apply to VLAN

# configure access-list PBR_DEFAULTROUTE.pol vlan "Test_ACL" ingress 

.Error: ACL policy PBR_DEFAULTROUTE.pol not found
Configuration failed on backup Node, command execution aborted!




Below is my original post on what I'm trying to accomplish but for this one I'm trying to enable this VLAN.




https://community.extremenetworks.com/extreme/topics/i-need-one-device-to-have-a-specific-ip-default...
Photo of Arison Mercado

Arison Mercado

  • 442 Points 250 badge 2x thumb

Posted 4 years ago

  • 0
  • 1
Photo of Hernandez, Joshua

Hernandez, Joshua, Employee

  • 1,564 Points 1k badge 2x thumb
Arison,

You should not have to enter the policy name with .pol extension.  Try it with just the policy name and no extension
Photo of Jeremy Thornton

Jeremy Thornton

  • 292 Points 250 badge 2x thumb
Try using this command edit policy PBR_DEFAULTROUTE. Even if the policy does not already exist, it will create it for you.... and like Josh said, you don't need to use the file extension when applying or modifying, it is implied. You only need to use the file extension when manipulating it within the file structure, i.e. copying to a tftp destination. 
Photo of Arison Mercado

Arison Mercado

  • 442 Points 250 badge 2x thumb
Jeremy, 

thanks for your help, I've applied the ACL as you described and I'm able to ping their network address's as well as there Firewall. I just can't get the redirect to point to their default gateway. Is there anything that I could be missing?
Photo of Jeremy Thornton

Jeremy Thornton

  • 292 Points 250 badge 2x thumb
Let me take a look at one of my pbr's and compare. This is being applied inbound on the VLAN for 192.168.2.0/27, right?
Photo of Prashanth KG

Prashanth KG, Employee

  • 5,300 Points 5k badge 2x thumb
Hi Arison,

Re-direct using an IP within a VLAN may not be possible. You could consider redirect-port <port number where the firewall is connected>.

 
Photo of Prashanth KG

Prashanth KG, Employee

  • 5,300 Points 5k badge 2x thumb
Policy could be modified as below: 

entry PBR {if match all {
source-address 192.168.2.0/24;
destination-address 0.0.0.0/0;


then {
      redirect-port <port no>;
}
}
Photo of Jeremy Thornton

Jeremy Thornton

  • 292 Points 250 badge 2x thumb
Yep, looks like my PBR's ar all to different VLANs. I re-read your problem and I am wondering why the firewall is not the def gw? You may have explained it, I just missed it. 
Photo of Zelnosky, Kevin

Zelnosky, Kevin, Employee

  • 1,124 Points 1k badge 2x thumb
I helped assist Arison with this through a GTAC case.  The reason why he cannot set the default gateway on the switch as the firewall, is that this is a remote hosting situation.

The end user is accessing servers on Arison's network, so he wanted all traffic related to the end user subnet to be redirected to the end user firewall.

The redirect ACL was always working, but it turns out the end user had a setting on their firewall that would deny traffic to the internet from any device without anti-virus.  After this setting was disabled, the test was successful.