Gateway ACL LAN to LAN feature is not working
I have configured VLANs 10, 20, 30, 100, and 200. The IPs are 192.168.x.0/24 (x being the VLAN ID).
VLAN 100 and 200 are applied on a SSID broadcast by my APs. I want to block access of VLAN 100 and 200 to all other VLANs. The VLANs are created with the purpose as interface, so routing is done on the gateway.
Gateway ACLs proven to be useless as I can still ping other VLANs when Im in both VLAN 100 and 200. A change the Switch ACL fixed the problem. What is the issue here and why does Gateway ACL not work?
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
Generally gateway ACLs still allow all the gatewai IPs of all vlans hosted on the gateway to be pingable. Why? who knows, just how it is.
In all other ways gateway lan<>lan ACLs work fine
- Copy Link
- Report Inappropriate Content
Thank you for your post. They should indeed work. How did you configure the ACL? Two ACL entries are required here, or you should enable bidirectional ACL blocking when configuring—once enabled, two ACL entries will be created automatically.
- Copy Link
- Report Inappropriate Content
I just came across this thread so I may be late in commenting here. In my network, the gateway ACLs work fine in preventing VLANs from reaching each other EXCEPT for the VLAN interfaces on the gateway. I can still ping the VLAN gateway address and navigate to the VLAN gateway's GUI. Just yesterday, I discovered that by creating an additional gateway rule to deny access for certain VLANs to the destination "Gateway Management Page", those VLANs can no longer access the gateway GUI. Setting the protocols to "All" also prevents the VLAN devices from pinging the gateway. In my case, I sometimes use a laptop on a particular VLAN for maintenance and testing. I changed the new gateway ACL to only deny the TCP protocol and this allows me to ping the gateway when needed.
- Copy Link
- Report Inappropriate Content
Be careful setting a lan<>lan ACL to the gateway page with "ALL" protocols - this will totally kill internet access for the vlans in the rule. (what actually kills it is having the ICMP protocol selected either on its own or with others / all). Selecting TCP is enough to prevent GMP GUI access
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 196
Replies: 4
Voters 0
No one has voted for it yet.