Mailing List Archive

ACL's on VE Int's (SI XL)
Is it possible to apply an ACL to a VE Int? (I don't think it is...)

SW: Version 07.4.01T12

(config)#in ve 2

(config-vif-2)#
clear Reset functions/remove keys
end End config-level commands
exit Exit current level commands
ip IP interface
link associate this virtual interface with an ISP
link
no Undo commands
quit Exit to user level
rshow Remote show system information
show Show system information
write Write running configuration to memory or
terminal
<cr>

Would I have to apply the acl to the eth int? Or is it not recommended
to use the SI as a "simple" firewall?
(I wanted to only allow arbitrary connections to ports 21,80+443 to the
real servers - And do not have a spare FW atm!)

TIA.

Regards,
MB
ACL's on VE Int's (SI XL) [ In reply to ]
On Thu, Dec 09, 2004 at 10:29:42AM +1000, Michael Bellears wrote:

> Is it possible to apply an ACL to a VE Int? (I don't think it is...)
>
> Would I have to apply the acl to the eth int? Or is it not recommended
> to use the SI as a "simple" firewall?
> (I wanted to only allow arbitrary connections to ports 21,80+443 to the
> real servers - And do not have a spare FW atm!)

conf term
int ve 2
ip access-group flow-mode
ip access-group 100 in

Should do the trick, atleast on BigIron/NetIron Foundry Boxen.

--
Cliff Albert <cliff@oisec.net>
ACL's on VE Int's (SI XL) [ In reply to ]
>
> conf term
> int ve 2
> ip access-group flow-mode
> ip access-group 100 in
>
> Should do the trick, atleast on BigIron/NetIron Foundry Boxen.

Doesn't appear to work on the SI's(Unfortunately!):

(config)#int ve 2
(config-vif-2)#ip
address <ip address> <subnet mask>
nat-address <ip address> <subnet mask>
rip
standby-address <ip address> <subnet mask>

Regards,
MB

>
> --
> Cliff Albert <cliff@oisec.net>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>