topic Re: ACL or policy in General Network Management

ACL or policy

Giuseppe_Montan — Tue, 04 May 2021 17:56:30 GMT

entry TestACL { if match all {
    source-address 192.168.1.0/24 ;
    destination-address 192.168.170.0/24 ;
} then {
    deny ;
} }

The customer configure this ACL on XOS, he ask me if is possible to replicate on XMC ?

Thanks

Giuseppe

Re: ACL or policy

Tomasz — Fri, 07 May 2021 03:39:31 GMT

Hi Giuseppe,

Is that the routing device or an access switch? If the latter, I’d consider using policy instead or move to the router for inter-VLAN routing restrictions if you don’t worry about unnecessary traffic reaching the router. If it’s your router, you could for example create a script in XMC that will execute following tasks on the switch:

tftp get to download a .pol file stored in XMC server somewhere
configure access-list ((name)) on relevant hardware piece such as port/VLAN/any

Hope that helps,

Tomasz

Re: ACL or policy

Giuseppe_Montan — Sat, 08 May 2021 23:57:36 GMT

Thanks for your reply

Is the routing device, I am looking for a policy to permit or deny the inter-vlan routing.

I will check the script.

Thanks

Giuseppe

Re: ACL or policy

Tomasz — Tue, 11 May 2021 22:15:36 GMT

Hi Giuseppe,

A policy using Policy feature in XMC could be done but it might be a bit of clicking depending on how many local VLANs you have. You could try to use an automated service for this (deny a resource which is a set of L3 locations and provide each subnet in the Resources). But such policy would have to be applied only to the router, as switches would cut off inside-VLAN communication even port-to-port. I don’t like point to myself but I think we can do a nice and concise ACL for the router and keep the Policy just for the access switches:

Hope that helps,

Tomasz