Problems getting switch ACL rules to trigger
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hardware: ER605 v2.0
Firmware: 2.0.1 Build 20220223 Rel.68551
Hardware: TL-SG2210P v3.20
Firmware: 3.20.6 Build 20221019 Rel.46702
Hardware: OC200 2.0
Controller Version: 5.6.4
Firmware: 2.6.1 Build 20220921 Rel.35903
Single Lan: 192.168.30.0/24
What I want:
1. Allow IP addresses 192.168.30.1 to 192.168.30.15 to have internet access always
2. Allow all other IP addresses to have internet access only during a certain time of day.
Seems fairly straight forward:
a. Defined time schedule:
SCHEDULE1 Every Day 05:00 am - 10:00 pm
b. Defined IP group:
GROUP1: IP Subnet: 192.168.30.0/28
(This should match IP addresses 192.168.30.1 to 192.168.30.15)
c. Created switch ACL, in the order listed:
1. Enabled, RULE1, Permit, All Protocols, Source: IP Group:GROUP1, Destination: IP Group:IPGroup_Any
2. Enabled, RULE2, Permit, All Protocols, Source: IP Group:IPGroup_Any, Destination: IP Group:IPGroup_Any, Time Range: Enable, SCHEDULE1
3. Enabled, RULE3, Deny, All Protocols, , Source: IP Group:IPGroup_Any, Destination: IP Group:IPGroup_Any
My idea was that RULE1 would match IP addresses 192.168.30.1 to 192.168.30.15 and therefor always permit them.
RULE2 is only active during SCHEDULE1 and will then permit any other traffic.
Outside of SCHEDULE1, RULE2 does nothing and RULE3 will block all other traffic.
But, I am clearly not thinking about this the right way.
With the ACLs in place, during the time window defined by SCHEDULE1, everything seems to work.
But outside of SCHEDULE1, all traffic is blocked. This leads me to the conclusion:
1. RULE1 does nothing
2. During SCHEDULE1, RULE2 allows all traffic
3. Outside of SCHEDULE1, RULE3 block all traffic.
Question, where am I going wrong and why does RULE1 not match the intended IP addresses?
(I've also tried listing all 15 addresses in IPGROUP1 (192.168.30.1/32 .... 192.168.30.15/32) but with the same result).
I have no VLANs other than the standard VLAN1
Any suggestions will be very much appreciated.
