[HELP] Multiple Network & VLAN with ACL - Unidirectional

[HELP] Multiple Network & VLAN with ACL - Unidirectional

[HELP] Multiple Network & VLAN with ACL - Unidirectional
[HELP] Multiple Network & VLAN with ACL - Unidirectional
2024-06-17 06:06:45 - last edited 2024-06-17 07:59:04

I have a multi VLAN network and i want to create a ACL to separate traffic, permit and deny the access of each vlans, and create a limited access.

 

The basic lan network.

 

name vlan subnet  
lan 1 192.168.0.1/24 with services like web hosting
vlan10 10

192.168.10.1/24

vlan20 20 192.168.20.1/24

 

 

My goal.

1. Give LAN (1) access to all

2. Deny VLAN10 and 20 to each other.

3. Give VLAN10 and 20 access to web hosting (i created a group for ip and port)

 

 

Here is what i did.

 

deny vlan access

-> created acl to deny access from vlan10 to 20 and 1, vlan20 to 10 and 1. - working

 

lan (1) have a web hosting and other services for all vlan.

-> created a acl to allow access on specific ip with their port - working.

 

but then lan lost access to vlan10 and vlan20

-> created a acl to allow lan access on vlan10 and vlan 20.

 

set up the ACL in switch.

 

Did i missed something or this can not work?

 

Thanks!

  0      
  0      
#1
Options
3 Reply
Re:[HELP] Multiple Network & VLAN with ACL - Unidirectional
2024-06-18 08:53:58 - last edited 2024-06-18 08:54:08

  @Jeesoon1 

The switch does not presently allow stateful ACLs. So, what you've set up isn't working. The first rule prevents all bidirectional connections. Currently, our gateway supports stateful ACL, but not for IP group+port. We will give feedback to our related department. However, I recommend that you strive to merge your services into a single VLAN so that you can meet your needs.

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#2
Options
Re:[HELP] Multiple Network & VLAN with ACL - Unidirectional
2024-06-19 02:45:29

  @Hank21 

 

Hello,

 

If i try to avoid using the IP group+port, would it work? Im sorry but i cannot merge it.

 

And would it possible to be a future update ?

  0  
  0  
#3
Options
Re:[HELP] Multiple Network & VLAN with ACL - Unidirectional
2024-06-20 02:20:38

  @Jeesoon1 

By "merge," I mean that you can try to group your web services into a single VLAN and then configure a gateway ACL. Add IP group and IP group+ port support is not yet available for Gateway ACL.Though the exact date of its addition is unknown, this feature addition has been under development and will likely be included in a future firmware.

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#4
Options