Posted on April 21, 2020 7:35 pm
 |  Asked by Kevin Malone
 |  140 views
RESOLVED
0
0
Print Friendly, PDF & Email

I’m trying to mimic a config I have built on my nexus switches to control traffic to a loopback address.  I basically want to allow a couple source ips to connect via ssh and one via bgp and deny everything else.  In nexus by default you can’t apply acls that will apply to loopback addresses until you enact “ip access-list match-local-traffic” command globally.  I cant seem to find this command on arista or anything like it.  I built the acl below to accomplish what I need but it’s not applying to “1.1.1.1” which is on a loopback interface.

IP Access List loopback-v4
counters per-entry
10 permit icmp any host 1.1.1.1
20 permit icmp any host 1.1.1.1 echo-reply
30 permit tcp host 2.2.2.2 host 1.1.1.1 eq ssh
40 permit tcp host 2.2.2.3 host 1.1.1.1 eq ssh
50 permit tcp host 2.2.2.4 host 1.1.1.1 eq ssh
60 permit tcp host 3.3.3.3 host 1.1.1.1 eq bgp
70 deny ip any host 1.1.1.1
80 permit ip any any

0
Answered on April 21, 2020 8:10 pm

Hi Kevin.

This type of restriction may be configured in different ways. Could you please confirm what is the hardware platform and software version in use? This will help confirming the correct configuration.

Thank you.

1
Posted by Kevin Malone
Answered on April 21, 2020 11:46 pm

model: Arista DCS-7280SR-48C6-F

Software: 4.23.0F

I did find this article which talks about changing the control plane ACL which could work.  But still curious if there is a way to make ACL's apply to local traffic (loopback interface) outside of changing the control plane ACL...

https://eos.arista.com/restricting-access-to-the-switch/

1
Answered on April 22, 2020 9:40 am

Hi Kevin.

Thanks for the information.

I believe that for your case, adjusting the control plane ACL is probably the best approach, and even though it is a different way of configuring, based on your requirements, I believe you would achieve the same goal as you can specify the IP address of the loopback interface.

The document listed by you should be helpful, although, in more recent releases, some CLI commands may be slightly different. For example: 'system control-plane' instead of 'control-plane'.

0
Posted by Kevin Malone
Answered on April 22, 2020 4:36 pm

I was able to lab this up and it worked adjusting the control plane ACL.  thanks Diogo.

Post your Answer

You must be logged in to post an answer.