applying acl on ve ip address

Question

Hi guys, I'm experiencing a new problem. I configured  an ACL  to restrict access from vlans to other vlans, applying it on virtual interface. If The traffic cannot reach the vlans  to which the ACL is applying, but the ip address assigned to the virtual interface is still reachable by the traffic coming from the Vlans that are blocked.  How can I prevent the ve ip address from accessing by blocked vlans?

unknown · Answer

Thanks you very much. I understand now  what I have to do with this. I will let you know....

unknown · Answer

I am sorry to have not written back sooner and for being somewhat unclear above.   The VRI has nothing to do with local traffic within a particular VLAN...  It is only used to get off the network by serving as a default-gateway.  It can also have IP helpers to listen and forward DHCP.Conceptually think of it as an old dumb layer-2 switch ( not capable of routing) with a physical interface of a router plugged into a switch interface... and another router interface plugged into another dumb layer-2 switch.   Each VLAN contains a collection of interfaces that serve as that conceptual dumb Layer-2 switch.  That ve is just like the router interface plugged into your L2 switch.  Hold the mental image of this network diagram above:Switch ——— Router ——— SwitchYou state...“I don’t want other VLANS blocked by a rule to gain access to the router...”The Access List (your control mechanism) is applied within the router portion of that diagram because where conceptually it is applied to a Layer-3 (routing) interface (the VE).  Your controls are IP based controls presumably by IP or subnet on an access-list.  ####You want to restrict management to manage your switch to IPs in the management VLAN..,There are a LOT of ways to do that.   One of the easiest is to remove the management VLANs SVI from the default VRF, so it is not routable from subnets outside.  This is in fact what Cisco does for Out-Of-Band-Management out of the box.If you have devices in this VLAN that need to then get out, you would have to treat this as a separate router and add traditional routing entries how to get to destination subnets via a next hop OR thou could use Policy-Based-Routing to take the source into effect.The above is probably too complex a way to accomplish what you want though.Your issue might be the type or location where you apply your access list.  In and Out confuses people regularly in that traffic doesn’t travel through interfaces but rather in or out. Very Important Concept:If you have management ve 123 and workstations ve 10.., If a management workstation sent packets to a workstation, those packets would come IN on ve 123 and then are processed by the routing table before going OUT of ve 10.  That is to say a packet need not ever come out of ve 123 to be inside the router.  Additionally said packet need not go into ve 10 to go out of ve 10... Generally standard ACLs Filter based on source but are typically placed near the destination.  Extended ACLs filter based on both source and destination; they are generally placed near the source to drop traffic before it is processed (I.e, routing table).Easiest Solution:(Config)#ssh access-group If it is even an option, I suggest a standard ACL to filter based on source.

unknown · Answer

Hi, Thanks you very much for your quick response. I understand very well what you mean. But in my case, I don't  want any other vlans that are blocked by a ruler in my ACL  get access to router (ve ip address) itself. The problem is, the concerned vlan is a management vlan  and the ACL suppose to permit only hosts in that vlan to connect to the router for managing it. But I've tried with an host in an other vlan and it is able to ping the ve ip address and connect to it using SSH. Furthermore, with this same host I cannot connect to a stack management ip address in the management vlan because is blocked by the ACL.So, my ACL can prevent stack from accessing by hosts that are in vlans  which are not permit to connect to it, but does anything to prevent router (ve interface) from accessing by these same hosts.This is my problem.....