VDX 6740 - How to control L3 traffic flow between vlans - with ACLs?

[Pawel_Eljasz]

hi guys

if I need to allow only certain nodes to access vlans behind VE iface do I do it with ACLs?

I think of that VE on VlanZ as a gateway to those nodes, through which the nodes would get to other Vlans.

Would I need to construct ACLs with all the subnets & hosts or there is another, simpler way?

And if yes, them I'm trying but... I fail. How would such a rule look like?
I'm trying something obvious:

deny ip any 10.5.8.0 255.255.255.0

then apply it to the VE iface as ingress, but... nodes which have VE's IP as the gateway to 10.5.8.0/24 still get there.

many thanks.

[Truyen_Phan]

When configuring ACLs on the VDX, the wildcard mask is inverted from the subnet mask.

https://en.wikipedia.org/wiki/Wildcard_mask

[Pawel_Eljasz]

What monstrosity is that?
How to read this notation?

[Truyen_Phan]

I just realized that your wild card mask has the wrong syntax.

Please try this ACL to block subnet 10.5.8.0 /24 and 10.5.7.0/24

code:

ip access-list extended protect-VLANs
seq 10 permit ip host 192.168.2.144 any
seq 50 deny ip any 10.5.8.0 0.0.0.255
seq 51 deny ip any 10.5.7.0 0.0.0.255
seq 90 permit ip any any

[Pawel_Eljasz]

Tried hard-drop, did not work neither.

Again: "I think of that VE on VlanZ as a gateway to those nodes, through which the nodes would get to other Vlans."

Anything that travels to & through VE(which nodes would claim as the gateway). Ex.:

code:

ip access-list extended protect-VLANs
seq 10 permit ip host 192.168.2.144 any
seq 50 deny ip any 10.5.8.0 255.255.255.0
seq 51 deny ip any 10.5.7.0 255.255.255.0
seq 90 permit ip any any

Replace deny with hard-drop, apply this ACL to VE and still nodes from 192.168.2.0/24 gets to nodes in/from vlan subnet 10.5.8.0.
That VE in physical layer is a port group(two phys ports) which link to the "rest" of the world.

Either it's some bug or ACLs cannot do that on their own, by design, and something else must along with ACLs must be fixed. Maybe PBR...

I also thought that ACLs would just work. I come from, still use, Dell and there (slightly older PC62xx) it's only ACLs you need to do the trick.