Labs / cisco security

Security ACL: Least-Privilege Access Between VLANs

beginner EVE-NG / Cisco IOS routers and switches aclsegmentationnetwork-security

Scenario

Finance (VLAN 10) and HR (VLAN 20) both route through R1. Right now, every host in Finance can reach every host in HR and vice versa — far more access than either department needs. HR only needs to reach one Finance file server on port 445 (SMB). Your goal is to apply least-privilege: allow only that specific traffic and deny everything else between the two VLANs.

Minimal addressing for this AddySec version

VLANNetworkKey host
VLAN 10 (Finance)192.168.10.0/24File server 192.168.10.50
VLAN 20 (HR)192.168.20.0/24HR-PC 192.168.20.10

Step 1 — Prove the over-permissive baseline

HR-PC# ping 192.168.10.50
HR-PC# telnet 192.168.10.50 3389

Both succeed today — HR can reach far more of Finance than it should (RDP access to the file server, for example, should never be needed from HR).

Step 2 — Write the least-privilege ACL

Allow only HR-PC to the file server on SMB (port 445), and explicitly deny the rest of Finance from HR, while leaving other traffic (like internet access) unaffected.

R1(config)# ip access-list extended HR-TO-FINANCE
R1(config-ext-nacl)# permit tcp host 192.168.20.10 host 192.168.10.50 eq 445
R1(config-ext-nacl)# deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
R1(config-ext-nacl)# permit ip any any

The final permit ip any any matters — without it, this ACL would silently block HR’s internet and other traffic too, because of the implicit deny at the end of every ACL.

Step 3 — Apply it on the correct interface and direction

R1(config)# interface vlan 20
R1(config-if)# ip access-group HR-TO-FINANCE in

Applying it inbound on the HR VLAN interface filters traffic as it leaves HR, before it reaches the rest of the network.

Step 4 — Verify least-privilege is enforced

HR-PC# telnet 192.168.10.50 445
HR-PC# telnet 192.168.10.50 3389

The SMB connection (445) should succeed; the RDP attempt (3389) should now fail — proving the ACL enforces exactly the access that was intended, nothing more.

Break it

Move the permit ip any any line above the deny line and retest. Notice HR regains full access to Finance — this reproduces the exact rule-order mistake from Firewall Policies and Rule Base Design, just written as an ACL instead of a firewall policy.

Reference

  • AddySec original content — written for the Network Security track, building on the Network Segmentation as a Security Control note.