[c-nsp] Wireless vlans and ACL

Dave Lim dave.daturax at gmail.com
Thu Mar 30 10:05:40 EST 2006


bridge irb

After studying the configuration, i realised that I am doing
integrated routing and bridging on this router, thus, all non-routable
traffic will be flooded on all forwarding interfaces in the bridge
group. Thus I am already briding this in layer 2, thus this layer 3
acl wouldn't work.

someone correct me if I am wrong.


On 3/30/06, Church, Chuck <cchurch at netcogov.com> wrote:
> You access-list 102 for inbound traffic is applied to the main radio
> interface, rather than the subint that has the IP address on it.  Try
> moving it to the .2 interface.  The outbound one on the subint isn't
> doing anything.
>
>
> Chuck Church
> Network Engineer
> CCIE #8776, MCNE, MCSE
> Netco Government Services
> Enterprise Network Engineering
> Home Office - 864-335-9473
> Cell - 864-266-3978
> cchurch at netcogov.com
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Dave Lim
> Sent: Thursday, March 30, 2006 9:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Wireless vlans and ACL
>
> Hi guys,
>
> I am trying to apply and acl on a wireless vlan. I have 2 vlans, vlan1
> (192.168.1.0/24) and vlan2 (192.168.2.0/24) Simple, I am trying to
> prevent vlan2 from accessing vlan1 but it can do a PAT overload to
> access the internet.
>
> I have tried applying the acl on interface dot11radio0.2 but to no
> avail. Traffic still goes through.
>
> Here's my config. Anyone?
>
> router1#sh run
> Building configuration...
>
> Current configuration : 6936 bytes
> !
> version 12.4
> service timestamps debug datetime msec
> service timestamps log datetime msec
> service password-encryption
> !
> hostname router1
> !
> boot-start-marker
> boot-end-marker
> !
> logging buffered 51200 warnings
> enable secret 5 $1$.0JF$MvriWPwkHm5wdw7hsjGaX/
> !
> aaa new-model
> !
> !
> aaa group server radius rad_eap
> !
> aaa group server radius rad_mac
> !
> aaa group server radius rad_acct
> !
> aaa group server radius rad_admin
> !
> aaa group server tacacs+ tac_admin
> !
> aaa group server radius rad_pmip
> !
> aaa group server radius dummy
> !
> aaa authentication login eap_methods group rad_eap
> aaa authentication login mac_methods local
> aaa authorization ipmobile default group rad_pmip
> aaa accounting network acct_methods start-stop group rad_acct
> !
> aaa session-id common
> !
> resource policy
> !
> clock timezone PCTime 8
> !
> !
> ip cef
> no ip dhcp use vrf connected
> ip dhcp excluded-address 10.10.10.1
> ip dhcp excluded-address 192.168.1.201 192.168.1.254
> ip dhcp excluded-address 192.168.1.1 192.168.1.100
> ip dhcp excluded-address 192.168.2.1 192.168.2.99
> !
> ip dhcp pool xxxxx at KA
>    import all
>    network 192.168.1.0 255.255.255.0
>    dns-server 210.193.2.34 210.193.2.36
>    default-router 192.168.1.1
> !
> ip dhcp pool xxxGuest
>    import all
>    network 192.168.2.0 255.255.255.0
>    dns-server 210.193.2.34 210.193.2.36
>    default-router 192.168.2.1
> !
> !
> no ip domain lookup
> ip domain name xxxxxxx
> ip name-server 210.193.2.34
> !
>
> !
> !
> !
> bridge irb
> !
> !
> !
> interface FastEthernet0
>  ip address 10.10.1.1 255.255.255.0
>  duplex auto
>  speed auto
> !
> interface BRI0
>  no ip address
>  encapsulation hdlc
>  shutdown
> !
> interface FastEthernet1
> !
> interface FastEthernet2
> !
> interface FastEthernet3
> !
> interface FastEthernet4
> !
> interface FastEthernet5
> !
> interface FastEthernet6
> !
> interface FastEthernet7
> !
> interface FastEthernet8
> !
> interface Dot11Radio0
>  no ip address
>  ip access-group 102 in
>  !
>
>  encryption vlan 2 mode ciphers tkip
>  !
>  ssid xxxGuest
>     vlan 2
>     authentication open
>     authentication key-management wpa
>     guest-mode
>     wpa-psk ascii 7 xxxxxxxx
>  !
>  speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0
> 36.0 48.0 54.0
>  station-role root
> !
> interface Dot11Radio0.2
>  ip address 192.168.2.1 255.255.255.0
> ip access-group 102 out
>  encapsulation dot1Q 2
>  ip nat inside
>  ip virtual-reassembly
>  no snmp trap link-status
>  no cdp enable
> !
> interface Dot11Radio0.100
>  no cdp enable
> !
> interface Dot11Radio0.120
>  no cdp enable
> !
> interface Dot11Radio1
>  no ip address
>  shutdown
>  speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
>  station-role root
>  no dot11 extension aironet
> !
> interface ATM0
>  no ip address
>  no ip redirects
>  no ip unreachables
>  no ip proxy-arp
>  no atm ilmi-keepalive
>  dsl operating-mode auto
> !
> interface ATM0.1 point-to-point
>  description $ES_WAN$$FW_OUTSIDE$
>  no ip redirects
>  no ip unreachables
>  no ip proxy-arp
>
>  pvc 0/100
>   encapsulation aal5mux ppp dialer
>   dialer pool-member 1
>  !
> !
> interface Vlan1
>  description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$
>  ip address 192.168.1.1 255.255.255.0
>  ip nat inside
>  ip virtual-reassembly
> !
> interface Vlan2
>  no ip address
> !
> interface Dialer0
>  description $FW_OUTSIDE$
>  ip address negotiated
>  ip access-group 101 in
>  no ip redirects
>  no ip unreachables
>  no ip proxy-arp
>  ip mtu 1452
> ip nat outside
>  ip virtual-reassembly
>  encapsulation ppp
>  ip route-cache flow
>  dialer pool 1
>  dialer-group 1
>  no cdp enable
>  ppp authentication pap callin
>  ppp pap sent-username xxxxxxxxxpassword 7xxxxxxxx
> !
> ip route 0.0.0.0 0.0.0.0 Dialer0
> ip route 192.168.10.0 255.255.255.0 FastEthernet0
> !
> !
> ip http server
> ip http authentication local
> ip http secure-server
> ip http timeout-policy idle 5 life 86400 requests 10000
> ip nat inside source list 1 interface Dialer0 overload
> !
> access-list 1 remark INSIDE_IF=Vlan1
> access-list 1 remark SDM_ACL Category=2
> access-list 1 permit 192.168.1.0 0.0.0.255
> access-list 1 permit any
> access-list 100 permit ip any any
> access-list 101 permit udp host 210.193.2.36 eq domain any
> access-list 101 permit udp host 210.193.2.34 eq domain any
> access-list 101 deny   ip 192.168.1.0 0.0.0.255 any
> access-list 101 permit icmp any any echo-reply
> access-list 101 permit icmp any any
> access-list 101 permit icmp any any unreachable
> access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
> access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
> access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
> access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
> access-list 101 deny   ip host 255.255.255.255 any
> access-list 101 deny   ip host 0.0.0.0 any
> access-list 101 deny   ip any 192.168.1.0 0.0.0.255
> access-list 101 permit ip any any
> access-list 102 deny   ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
> access-list 102 permit ip any any
> dialer-list 1 protocol ip permit
> no cdp run
>
> radius-server attribute 32 include-in-access-req format %h
> radius-server vsa send accounting
> !
> control-plane
> !
> !
> line con 0
> line aux 0
> line vty 0 4
>  privilege level 15
>  transport input telnet ssh
> line vty 5 15
>  privilege level 15
>  transport input telnet ssh
> !
> !
> webvpn context Default_context
>  ssl authenticate verify all
>  !
>  no inservice
> !
> end
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



More information about the cisco-nsp mailing list