Implementing VLAN ACLs in a Cisco Systems Switch

How many times have we needed to protect a given host from its neighbors of the same Broadcast Domain (VLAN)? As is widely known this kind of practice is often performed by implementing local Firewalls on Workstation and Servers. For example, Linux has IPTables, Windows since the release XP includes Windows Firewall and Apple OS-X has a Firewall service as well. Also, the requirement can be performed by third party vendors such as Symantec, F-Secure and so on.

The coming example wants to demonstrate how a Cisco Systems Switch is able to perform this goal by implementing VLAN ACLs (VACL). Please keep in mind there is not any routing process involved, even more, the switch has not IP routing enabled.

The given topology has not anything specialized, only three computers connected to a switch. One of those computers runs Linux, other runs Windows and the other one runs OS-X. The Switch is a Cisco Systems Catalyst 3560, which runs IOS c3560-ipservicesk9-mz.122-55.SE11.bin. In addition, the Switch has almost its default configuration, I only added VLAN11 and some more commands, nothing special. The initial configuration is shared below.

version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname switch01 ! boot-start-marker boot-end-marker ! ! ! ! no aaa new-model system mtu routing 1500 vtp mode transparent ! ! ! ! ! ! ! ! spanning-tree mode pvst spanning-tree portfast default spanning-tree portfast bpdufilter default spanning-tree extend system-id ! vlan internal allocation policy ascending ! vlan 11 name Lab ! ! ! ! interface FastEthernet0/1 switchport access vlan 11 switchport mode access ! interface FastEthernet0/2 switchport access vlan 11 switchport mode access ! interface FastEthernet0/3 switchport access vlan 11 switchport mode access ! interface FastEthernet0/4 switchport access vlan 11 switchport mode access ! interface FastEthernet0/5 switchport access vlan 11 switchport mode access ! interface FastEthernet0/6 switchport access vlan 11 switchport mode access ! interface FastEthernet0/7 switchport access vlan 11 switchport mode access ! interface FastEthernet0/8 switchport access vlan 11 switchport mode access ! interface FastEthernet0/9 switchport access vlan 11 switchport mode access ! interface FastEthernet0/10 switchport access vlan 11 switchport mode access ! interface FastEthernet0/11 switchport access vlan 11 switchport mode access ! interface FastEthernet0/12 switchport access vlan 11 switchport mode access ! interface FastEthernet0/13 switchport access vlan 11 switchport mode access ! interface FastEthernet0/14 switchport access vlan 11 switchport mode access ! interface FastEthernet0/15 switchport access vlan 11 switchport mode access ! interface FastEthernet0/16 switchport access vlan 11 switchport mode access ! interface FastEthernet0/17 switchport access vlan 11 switchport mode access ! interface FastEthernet0/18 switchport access vlan 11 switchport mode access ! interface FastEthernet0/19 switchport access vlan 11 switchport mode access ! interface FastEthernet0/20 switchport access vlan 11 switchport mode access ! interface FastEthernet0/21 switchport access vlan 11 switchport mode access ! interface FastEthernet0/22 switchport access vlan 11 switchport mode access ! interface FastEthernet0/23 switchport access vlan 11 switchport mode access ! interface FastEthernet0/24 switchport access vlan 11 switchport mode access ! interface FastEthernet0/25 switchport access vlan 11 switchport mode access ! interface FastEthernet0/26 switchport access vlan 11 switchport mode access ! interface FastEthernet0/27 switchport access vlan 11 switchport mode access ! interface FastEthernet0/28 switchport access vlan 11 switchport mode access ! interface FastEthernet0/29 switchport access vlan 11 switchport mode access ! interface FastEthernet0/30 switchport access vlan 11 switchport mode access ! interface FastEthernet0/31 switchport access vlan 11 switchport mode access ! interface FastEthernet0/32 switchport access vlan 11 switchport mode access ! interface FastEthernet0/33 switchport access vlan 11 switchport mode access ! interface FastEthernet0/34 switchport access vlan 11 switchport mode access ! interface FastEthernet0/35 switchport access vlan 11 switchport mode access ! interface FastEthernet0/36 switchport access vlan 11 switchport mode access ! interface FastEthernet0/37 switchport access vlan 11 switchport mode access ! interface FastEthernet0/38 switchport access vlan 11 switchport mode access ! interface FastEthernet0/39 switchport access vlan 11 switchport mode access ! interface FastEthernet0/40 switchport access vlan 11 switchport mode access ! interface FastEthernet0/41 switchport access vlan 11 switchport mode access ! interface FastEthernet0/42 switchport access vlan 11 switchport mode access ! interface FastEthernet0/43 switchport access vlan 11 switchport mode access ! interface FastEthernet0/44 switchport access vlan 11 switchport mode access ! interface FastEthernet0/45 switchport access vlan 11 switchport mode access ! interface FastEthernet0/46 switchport access vlan 11 switchport mode access ! interface FastEthernet0/47 switchport access vlan 11 switchport mode access ! interface FastEthernet0/48 switchport access vlan 11 switchport mode access ! interface GigabitEthernet0/1 ! interface GigabitEthernet0/2 ! interface GigabitEthernet0/3 ! interface GigabitEthernet0/4 ! interface Vlan1 no ip address shutdown ! ip classless no ip http server no ip http secure-server ! ! ! ! ! line con 0 line vty 5 15 ! end

Each computer has a static IP address assigned:
192.168.11.1/24 - - > Windows computers
192.168.11.11/24 - - > Linux box
192.168.11.111/24 - - > Apple computer

By the way, the switch has not a IP address assigned, because it is not required.

The Windows computer has Windows Firewall disabled, and the service of File and Printer Sharing (SMB) enabled.

The Linux box is publishing three folders by running python -m SimpleHTTPServer TCP-PORT. The web publishing service is assigning an unique TCP port to each folder, from 10001 to 10003.

The OS-X computer manages the switch through a serial port, sends some pings to Windows (192.168.11.1) and the Linux box (192.168.11.11), displays the content of each web folder (Text01, Text02...) and connects to the Windows computer through SMB. Everything happens as expected, everything is normal, nothing fancy.

The interesting thing starts once the VACL commands are introduced to the switch. As you can noticed in the video below, the Windows computer continues working normally. That is to say, Windows continues answering PING and sharing folders.

The lab has been focused on the Linux box. So, after introducing the VACLs commands in the switch, the Linux box stopped answering PING, also the administrator has decided to disable the TCP port 10003 to be reachable by the hosts in the same VLAN.

Let's watch a video to get a visual idea, step by step of the described topology.

The commands used by the VLAN ACL are shared below:

vlan access-map VACCESS-MAP-11 10 action forward match ip address VACL11-webfolder01 vlan access-map VACCESS-MAP-11 20 action forward match ip address VACL11-webfolder02 vlan access-map VACCESS-MAP-11 30 action drop match ip address VACL11-Ubuntu vlan access-map VACCESS-MAP-11 40 action forward ip access-list extended VACL11-webfolder01 permit tcp any any eq 10001 permit tcp host 192.168.11.11 any established ip access-list extended VACL11-webfolder02 permit tcp any any eq 10002 permit tcp host 192.168.11.11 any established ip access-list extended VACL11-Ubuntu permit ip any host 192.168.11.11 vlan filter VACCESS-MAP-11 vlan-list 11

In addition to the first example, I would like to share one more example.

The next example consists of only two computers connected to a Cisco Systems switch. The switch has its configuration almost by default, only the switch ports have been modified as access ports. So, everything is running in VLAN1.

Each computer has two IP address statically assigned:
192.168.100.11/24 and 192.168.200.11/24 - - > Apple computer
192.168.100.12/24 and 192.168.200.12/24 - - > Linux box
As the coming video shows, each computer can PING request and reply without any problem. But, as soon the VACL commands are deployed in the Switch, the normal development changes, and the addresses corresponding to the network 192.168.200.0/24 are sudenly stopped.

The commands used by the VLAN ACL are shared below:

ip access-list standard VACL-VLAN1 permit 192.168.100.0 0.0.0.255 vlan access-map VACCESS-MAP-1 10 action forward match ip address VACL-VLAN1 vlan filter VACCESS-MAP-1 vlan-list 1

Conclusion:

Deploying VACLs could be considered an important security feature for our networks. Also, in this manner, an administrator can avoid applying features locally in servers and workstations, instead running this features in specialized equipment for saving performance to the host and getting a more granular control.