topic Re: EXOS 22.7.x.x - ACL Preventing Layer 2 Communication between clients in the same subnet. in ExtremeSwitching (EXOS/Switch Engine)

EXOS 22.7.x.x - ACL Preventing Layer 2 Communication between clients in the same subnet.

RobertWilkinson — Wed, 10 Feb 2021 20:10:50 GMT

Anyone else got an issue with clients communicating with each other on the same subnet if deploying an ACL Policy on egress of a VLAN.

In Cisco world a normal RFC1918 ACL Egressing the VLAN is sufficient for a guest network, clients can still communicate with each other but this can be additionally adjusted with an ACL.

It seems in EXOS as soon as you define an ACL it enables a type of Client Isolation and the only way around this would be to specifically allow client to client config via an additional rule to allow egress traffic of the whole subnet.

Re: EXOS 22.7.x.x - ACL Preventing Layer 2 Communication between clients in the same subnet.

Stefan_K_ — Wed, 10 Feb 2021 22:16:22 GMT

Could you show us the ACL you created?

Re: EXOS 22.7.x.x - ACL Preventing Layer 2 Communication between clients in the same subnet.

RobertWilkinson — Wed, 10 Feb 2021 22:52:12 GMT

@Stefan K.

Something like this;

entry 1 {
if match all {
destination-address 10.0.0.0/8 ;
}
then {
deny ;
count deny ;
}
}
entry 2 {
if match all {
destination-address 172.16.0.0/12 ;
}
then {
deny ;
count deny ;
}
}
entry 3 {
if match all {
destination-address 192.168.0.0/16 ;
}
then {
deny ;
count deny ;

Applied to a VLAN on Egress, lets say VLAN100, if i have two clients configured on the same switch that is doing the L3 they cannot communicate with each other…. i’ve never had this with Cisco\HP\Dell.

The only way i can then get it to work is with an additional entry of;

if match all {
source-address 192.168.1.0/24 ;
destination-address 192.168.1.0/24 ;
}
then {
permit ;
}
}

Having the an ACL blocking access to the RFC1918 subnets also blocks routing protocols like VRRP, but i have seen another article on that and that only seems to really effect the likes of VRRP if the ACL is on Ingress.

Re: EXOS 22.7.x.x - ACL Preventing Layer 2 Communication between clients in the same subnet.

RobertWilkinson — Mon, 29 Mar 2021 23:22:05 GMT

Turns out it works on Ingress on the VLAN, Cisco and Enterasys is the opposite way. All sorted now.

Still have to have an entry that has the L2 subnet as a source and destination to allow clients to reach each other but not a major issue, just not usual behavior for other vendor ACL’s.