ACL on ports

[destinyml]

Hi

I'm trying to setup access control lists on my cisco 2960 switch. The idea is that each server connected to a switch port will have its own access control list. Eg. only allow ssh access to a server from a specific IP address.

My problem is that that the switch interface is limited to only allowing the "in" parametre of the "ip access-group" command. That is I can only use acl for controlling access of server outboud usage.

Any ideas how to accomplish my goal? Should I use VLANs?

 

[chipk]

You could use vlans, or isolate one switch to host your servers, to create a sort of "server farm", and filter traffic there, but then you have to worry about blocking other valid traffic. It might be easier to just do a personal firewall on the server. Are you using Windows or Unix?

 

[destinyml]

I don't have access to the os of the servers connected to the switch, so a software firewall is not posible.

If I set up a vlan for each port I will be able to define both "in" and "out" acls (as far as I understand) but the servers connected to the switch also need to be able to communicate internally and they are on the same subnet. I haven't got too much experience with vlans, so I'm not sure if I can use vlans. And how to.

 

[helpdeskdan]

Yeah, we were just talking about something like this the other day:

http://www.tek-tips.com/viewthread.cfm?qid=1346064

So, the servers need to be able to contact each other, but clients should only be able to connect to a specific port? Put the servers all on one vlan, the clients in another and setup vlan routing on your switch. Then, put an access list on the server vlan interface that will only allow incoming ssh from certain clients. Granted, I don't know if your 2960 supports intervlan routing.

 

[destinyml]

Will intervlan routing also work if clients and servers are on the same subnet?

We do have a 3750 SMI switch (as the primary switch) and as far as I can tell from

http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a008015f17a.shtml

it is supported.

 

[helpdeskdan]

There was a really good cisco site to look this up and I can't remember where it was...

Anyway, yes, a 3750 should do, but no, it won't work between clients and servers on the same subnet because they both need access to the same gateway. 1 subnet to 1 vlan.

You could either segment your subnet, or perhaps use a vlan access list which we discussed in the other thread.