Wired Intelligent Edge

last person joined: 23 hours ago 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

ACL activities in start-topology network...

This thread has been viewed 0 times

  • 1.  ACL activities in start-topology network...

    Posted Dec 22, 2018 04:40 AM

    Hello,

     

    I have "normal" star topolgy network with 2530/2540 edges and 5406 core stack and over 10 vlans to host all necessary networks. 5406 is running on route mode and acts as router between networks. All vlan's has ACL which are attached to vlan's in-queue (for example cli: ip access-group "ACL113" in)

     

    Question is: in what point attached ACL's rules appies to traffic?
    If there is traffic from imaginary EDGE-1 switches untagged vlan 113 port to EDGE-2 switches untagged vlan 113 port where traffic passes through routing core where vlan 113 has attached acl, does acl rules apply to traffic betweeb EDGE-1 and EDGE-2?

     

    I have weird discovery problem in one vlan and I just started to think that possibly I assume acl's working different than they actually are.



  • 2.  RE: ACL activities in start-topology network...
    Best Answer

    MVP GURU
    Posted Dec 22, 2018 07:55 AM

    Hi,

     

    ACL work only when there is a change of vlan (-> Routing)



  • 3.  RE: ACL activities in start-topology network...

    Posted Dec 22, 2018 09:06 AM

    Thanks for information! I almost hoped NOT to get information you gave :D

     

    I think this is bad way to ask this question but while problematic discovery protocol is mDNS and Bonjour which both uses multicast and all equipments are in 169.254.0.0/16 address space is there limitations in IGMP functionality how Aruba/HPE swithces can or cannot pass multicast to rest of the L2 network? I mean that if I put problematic gear to other vlan having identical igmp snooping config and 10.10.1.0/24 network discovery works just fine.

     

     



  • 4.  RE: ACL activities in start-topology network...

    MVP GURU
    Posted Dec 22, 2018 12:16 PM
    @JorchRock67 wrote:

    Thanks for information! I almost hoped NOT to get information you gave :D

     

    I think this is bad way to ask this question but while problematic discovery protocol is mDNS and Bonjour which both uses multicast and all equipments are in 169.254.0.0/16 address space is there limitations in IGMP functionality how Aruba/HPE swithces can or cannot pass multicast to rest of the L2 network? I mean that if I put problematic gear to other vlan having identical igmp snooping config and 10.10.1.0/24 network discovery works just fine.

     

     

    Open a new topic