Solved

Allow access from PC only to one IP address

Posted on 2011-09-06
4
416 Views
Last Modified: 2012-05-12
Dear Experts,

We have a monitoring PC [vendor supplied - WinXP] for our SAN on our network. The PC has LogMeIn installed so the remote techs can access the PC and thus the SAN if an alert is triggered.

The goal is to configure the PC so they only have access to the SAN [single IP address] and not the rest of our network. It's not my PC so I'm somewhat limited on what I can do. I'm kind of looking for something that would work like an ACL, allow traffic from only this source IP to this destination IP.

The PC is connected to a Cisco 2980 layer 2 switch.

Would the route table on the PC be able to do what I need?
Can a layer 2 switch handle an ACL like this?

TIA,

Mike
0
Comment
Question by:ENCL
  • 2
4 Comments
 
LVL 18

Accepted Solution

by:
jmeggers earned 500 total points
Comment Utility
I'm not familiar with the 2980, but the only one I see was EOL back in 2004, and has been out of support since 2009.  From what I read, it sounds like it's layer 2 only, but even so you should still be able to do a MAC ACL. The challenge is the correct syntax for it.  If you can find out what image you're running that would help.  

On current switches, the syntax typically looks something like what's below, but there's no guarantee this will work on your switch:

mac access-list extended MAC-Test
 permit host 1234.5678.9012 host 7890.1234.5678

interface fa1/0/10
mac access-group MAC-Test in
0
 
LVL 2

Expert Comment

by:JohnnyIT
Comment Utility
While I'm not certain on how exactly, I believe this can be achieved by adjusting the routing table on the PC.

In a cmd prompt, type "Route Print"  Somewhere about the middle of the output, you'll see a line like this:

    192.168.1.0    255.255.255.0     192.168.1.95    192.168.1.95       20

"192.168.1.0" being the entire subnet, and "192.168.1.95" being the IP of the computer you're working on.

If you change the "0" to the IP of the SAN, that might work.  (I've never tried this though)




Alternatively, if you have security software installed, you can use the firewall to simply block traffic to everything except logmein and the SAN. Then password-protect the software.



Alternatively, does the SAN support multiple IP's??  If so, give it another IP on a different subnet, then set the monitoring PC to that same subnet.  (although that doesn't guarantee anything)


0
 

Author Comment

by:ENCL
Comment Utility
Hi Guys,

Thanks for the ideas, I'm going to try the MAC address ACL, this would be the most secure method for us. Plus, the remote tech could potential change the local route table if he knew how. I'll test later today or tomorrow and provide some feedback.

Regards,

Mike
0
 

Author Closing Comment

by:ENCL
Comment Utility
Thanks for the help.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now