From: Xiangling (xianglingzj@gmail.com)
Date: Thu Dec 04 2008 - 03:44:59 ARST
When I was learning reflexive ACL I think if you put the ACL only on a
single direction but not on the other direction, it will be treated the same
as the normal ACL (e.g., without the "relfect" keyword). Until recently I
met a real case I found myself wrong:
The topology of the case is shown below:
WLAN Client---WLAN Controller----6509 Switch----6509 Switch---FW and
Router----Internet
The WLAN clients are assigned IP addresses 172.27.0.0/16 and the NAT is done
on the first 6509 switch connecting to the WLAN controller, the inside
interface connecting to the WLAN controller is configured as below.
!
interface Vlan812
description ADMIN-WLAN-Controller
ip address 192.168.210.21 255.255.255.240
no ip redirects
ip nat inside
standby 1 ip 192.168.210.30
standby 1 priority 120
!
and the NAT configuration is shown below:
!
ip nat pool pool-ADMIN2 11.11.18.1 11.11.18.252 prefix-length 24
ip nat inside source route-map MAP-ADMIN2 pool pool-ADMIN2
!
ip access-list extended WLAN-ADMIN2
deny ip 172.27.0.0 0.0.255.255 11.11.0.0 0.0.255.255
deny tcp 172.27.0.0 0.0.255.255 any eq www
deny ip 172.27.0.0 0.0.255.255 192.168.0.0 0.0.255.255
deny ip 172.27.0.0 0.0.255.255 172.16.0.0 0.15.255.255
deny ip 172.27.0.0 0.0.255.255 10.0.0.0 0.255.255.255
permit ip 172.27.0.0 0.0.255.255 any log
!
route-map MAP-ADMIN2 permit 10
match ip address WLAN-ADMIN2
!
With the following configuration, some wierd thing happens that only TCP
traffic is translated but not the UDP traffic, this causes some applications
which are relying on UDP fail to work.
ADMIN2#sh ip nat tran | in udp
ADMIN2#sh ip nat tran | in udp
ADMIN2#sh ip nat tran | in udp
More interesting thing is observed that after the following configuration
the UDP is now translated and the application start to work:
ADMIN2#config t
Enter configuration commands, one per line. End with CNTL/Z.
ADMIN2(config)#ip acce
ADMIN2(config)#ip access-list ex
ADMIN2(config)#ip access-list extended test812.in
ADMIN2(config-ext-nacl)#permit ip any any
ADMIN2(config-ext-nacl)#int vlan 812
ADMIN2(config-if)#ip acce
ADMIN2(config-if)#ip access-group test812.in in
ADMIN2(config-if)#end
ADMIN2#sh ip int vlan 812
Vlan812 is up, line protocol is up
Internet address is 192.168.210.21/28
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Multicast reserved groups joined: 224.0.0.2 224.0.0.5 224.0.0.6
Outgoing access list is not set
Inbound access list is test812.in
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are never sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP Flow switching is disabled
IP CEF switching is enabled
IP Feature Fast switching turbo vector
IP Feature CEF switching turbo vector
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain inside
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
BGP Policy Mapping is disabled
Sampled Netflow is disabled
IP multicast multilayer switching is disabled
ADMIN2#sh ip access test812.in
Extended IP access list test812.in
permit ip any any (23 matches)
ADMIN2(config)#ip access-list ex test812.in
ADMIN2(config-ext-nacl)#permit ip any any ref REF
ADMIN2(config-ext-nacl)#no permit ip any any
ADMIN2(config-ext-nacl)#do sh ip access test812.in
Extended IP access list test812.in
permit ip any any reflect REF (4 matches)
ADMIN2# sh ip nat tran | in udp
udp 11.11.18.9:3450 172.27.72.242:3450 63.210.157.46:13001
63.210.157.46:13001
udp 11.11.18.9:22860 172.27.72.242:22860 64.127.123.234:14280
64.127.123.234:14280
udp 11.11.18.9:22861 172.27.72.242:22861 64.127.123.234:14281
64.127.123.234:14281
udp 11.11.18.9:3450 172.27.72.242:3450 216.82.21.250:13001
216.82.21.250:13001
udp 11.11.18.9:3450 172.27.72.242:3450 8.2.35.16:13000 8.2.35.16:13000
udp 11.11.18.9:22860 172.27.72.242:22860 70.42.62.102:3478 70.42.62.102:3478
udp 11.11.18.9:22861 172.27.72.242:22861 70.42.62.102:3478 70.42.62.102:3478
udp 11.11.18.9:22860 172.27.72.242:22860 70.42.62.103:3478 70.42.62.103:3478
udp 11.11.18.9:22862 172.27.72.242:22862 70.42.62.102:3478 70.42.62.102:3478
udp 11.11.18.9:22862 172.27.72.242:22862 70.42.62.103:3478 70.42.62.103:3478
udp 11.11.18.9:22891 172.27.72.242:22891 70.42.62.102:3478 70.42.62.102:3478
Anybody can help me explaining the difference between no access list,
"permit ip any any" and "permit ip any any ref REF" when only ingress ACL is
applied? Thanks.
Thanks & Regards,
Xiangling
|-------------------------|
| |
\ I Love You All /
\ /
\___________/
Blogs and organic groups at http://www.ccie.net
This archive was generated by hypermail 2.1.4 : Thu Jan 01 2009 - 12:53:07 ARST