Solved

Allow access from PC only to one IP address

Posted on 2011-09-06
4
419 Views
Last Modified: 2012-05-12
Dear Experts,

We have a monitoring PC [vendor supplied - WinXP] for our SAN on our network. The PC has LogMeIn installed so the remote techs can access the PC and thus the SAN if an alert is triggered.

The goal is to configure the PC so they only have access to the SAN [single IP address] and not the rest of our network. It's not my PC so I'm somewhat limited on what I can do. I'm kind of looking for something that would work like an ACL, allow traffic from only this source IP to this destination IP.

The PC is connected to a Cisco 2980 layer 2 switch.

Would the route table on the PC be able to do what I need?
Can a layer 2 switch handle an ACL like this?

TIA,

Mike
0
Comment
Question by:ENCL
  • 2
4 Comments
 
LVL 18

Accepted Solution

by:
jmeggers earned 500 total points
ID: 36493088
I'm not familiar with the 2980, but the only one I see was EOL back in 2004, and has been out of support since 2009.  From what I read, it sounds like it's layer 2 only, but even so you should still be able to do a MAC ACL. The challenge is the correct syntax for it.  If you can find out what image you're running that would help.  

On current switches, the syntax typically looks something like what's below, but there's no guarantee this will work on your switch:

mac access-list extended MAC-Test
 permit host 1234.5678.9012 host 7890.1234.5678

interface fa1/0/10
mac access-group MAC-Test in
0
 
LVL 2

Expert Comment

by:JohnnyIT
ID: 36493387
While I'm not certain on how exactly, I believe this can be achieved by adjusting the routing table on the PC.

In a cmd prompt, type "Route Print"  Somewhere about the middle of the output, you'll see a line like this:

    192.168.1.0    255.255.255.0     192.168.1.95    192.168.1.95       20

"192.168.1.0" being the entire subnet, and "192.168.1.95" being the IP of the computer you're working on.

If you change the "0" to the IP of the SAN, that might work.  (I've never tried this though)




Alternatively, if you have security software installed, you can use the firewall to simply block traffic to everything except logmein and the SAN. Then password-protect the software.



Alternatively, does the SAN support multiple IP's??  If so, give it another IP on a different subnet, then set the monitoring PC to that same subnet.  (although that doesn't guarantee anything)


0
 

Author Comment

by:ENCL
ID: 36495844
Hi Guys,

Thanks for the ideas, I'm going to try the MAC address ACL, this would be the most secure method for us. Plus, the remote tech could potential change the local route table if he knew how. I'll test later today or tomorrow and provide some feedback.

Regards,

Mike
0
 

Author Closing Comment

by:ENCL
ID: 36496823
Thanks for the help.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now