Acl on vlan51

ACL / Access Lists on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to create extended ACLs on HPE Aruba ArubaOS-Switch and apply them to a VLAN interface. This example restricts a guest wireless network from accessing any internal address space while allowing internet access.

Scenario #

Guest network subnet: 192.168.0.0/23. Guests must reach the internet but must not reach any RFC1918 internal ranges.

Create the ACL #

cli

ip access-list extended "GUEST-ACL"
 10 permit ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.1.255
 20 deny ip 192.168.0.0 0.0.1.255 10.0.0.0 0.255.255.255 log
 30 deny ip 192.168.0.0 0.0.1.255 172.16.0.0 0.15.255.255 log
 40 deny ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.255.255 log
 50 permit ip 192.168.0.0 0.0.1.255 0.0.0.0 255.255.255.255 log
 exit

Line 10 — permits intra-subnet traffic (required for hosts on the /23 to communicate with each other)
Lines 20, 30, 40 — deny RFC1918 ranges
Line 50 — permit all other destinations (internet)

Apply to the VLAN interface #

cli

vlan 10
 name "Guest Network"
 ip access-group "GUEST-ACL" in
 ip address 192.168.0.1 255.255.254.0
exit

The ACL is applied inbound (in) — it inspects traffic as it arrives from guest clients.

Hardening HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.

Note: HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.

Disable insecure protocols #

cli

undo ip http server enable
undo telnet server enable

Enable SSH and HTTPS #

cli

ip https enable
ssh server enable

Restrict VTY to SSH only #

cli

user-interface vty 0 4
 protocol inbound ssh

Restrict management access with an ACL #

cli

acl number 2050
 rule 5 permit source 1.2.3.4 0
 rule 10 permit source 10.0.0.0 0.255.255.255
 rule 15 permit source 192.168.0.0 0.0.255.255

Apply to HTTPS and SSH:

Policy Based Routing (PBR) on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Comware v7. Traffic is matched by ACLs and redirected to an alternative next-hop, overriding the routing table.

Scenario #

The setup is identical to the ArubaOS-Switch PBR guide. The switch (.254) has a default gateway of 2.2.2.1.

PBR topology: local breakout via the default gateway, internet via the firewall at 1.1.1.1

From 192.168.10.0/24: internal traffic (to 10.0.0.0/8 or 192.168.0.0/16) uses the normal routing table, internet traffic is sent to 1.1.1.1.

Restricting SMTP Access with ACLs on Citrix NetScaler

Thu, 01 Oct 2015 00:00:00 +0000

I had to configure a Citrix NetScaler (version 10.5) to load balance SMTP for an organisation that relayed mail through Microsoft’s smart host. Only specific source IP addresses should be able to reach port 25.

This is all done from the CLI. In the GUI, the same settings are under Configuration → System → Network → ACLs.

In this example, the permitted senders are 1.1.1.1 and 2.2.2.2.

Create the ACLs #

cli

> add ns acl ALLOW-SMTP-1.1.1.1 ALLOW -srcIP = 1.1.1.1 -destPort = 25 -protocol TCP -priority 10
 Done
> add ns acl ALLOW-SMTP-2.2.2.2 ALLOW -srcIP = 2.2.2.2 -destPort = 25 -protocol TCP -priority 20
 Done
> add ns acl RESTRICT-SMTP-ALL DENY -srcIP = 0.0.0.0-* -destPort = 25 -protocol TCP -priority 50
 Done

There’s no implicit deny or permit at the end of a NetScaler ACL list, so you need the explicit DENY rule to block everyone else. Lower priority numbers are evaluated first.