Solved

Allow access from PC only to one IP address

Posted on 2011-09-06
4
424 Views
Last Modified: 2012-05-12
Dear Experts,

We have a monitoring PC [vendor supplied - WinXP] for our SAN on our network. The PC has LogMeIn installed so the remote techs can access the PC and thus the SAN if an alert is triggered.

The goal is to configure the PC so they only have access to the SAN [single IP address] and not the rest of our network. It's not my PC so I'm somewhat limited on what I can do. I'm kind of looking for something that would work like an ACL, allow traffic from only this source IP to this destination IP.

The PC is connected to a Cisco 2980 layer 2 switch.

Would the route table on the PC be able to do what I need?
Can a layer 2 switch handle an ACL like this?

TIA,

Mike
0
Comment
Question by:ENCL
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 18

Accepted Solution

by:
jmeggers earned 500 total points
ID: 36493088
I'm not familiar with the 2980, but the only one I see was EOL back in 2004, and has been out of support since 2009.  From what I read, it sounds like it's layer 2 only, but even so you should still be able to do a MAC ACL. The challenge is the correct syntax for it.  If you can find out what image you're running that would help.  

On current switches, the syntax typically looks something like what's below, but there's no guarantee this will work on your switch:

mac access-list extended MAC-Test
 permit host 1234.5678.9012 host 7890.1234.5678

interface fa1/0/10
mac access-group MAC-Test in
0
 
LVL 2

Expert Comment

by:JohnnyIT
ID: 36493387
While I'm not certain on how exactly, I believe this can be achieved by adjusting the routing table on the PC.

In a cmd prompt, type "Route Print"  Somewhere about the middle of the output, you'll see a line like this:

    192.168.1.0    255.255.255.0     192.168.1.95    192.168.1.95       20

"192.168.1.0" being the entire subnet, and "192.168.1.95" being the IP of the computer you're working on.

If you change the "0" to the IP of the SAN, that might work.  (I've never tried this though)




Alternatively, if you have security software installed, you can use the firewall to simply block traffic to everything except logmein and the SAN. Then password-protect the software.



Alternatively, does the SAN support multiple IP's??  If so, give it another IP on a different subnet, then set the monitoring PC to that same subnet.  (although that doesn't guarantee anything)


0
 

Author Comment

by:ENCL
ID: 36495844
Hi Guys,

Thanks for the ideas, I'm going to try the MAC address ACL, this would be the most secure method for us. Plus, the remote tech could potential change the local route table if he knew how. I'll test later today or tomorrow and provide some feedback.

Regards,

Mike
0
 

Author Closing Comment

by:ENCL
ID: 36496823
Thanks for the help.
0

Featured Post

Enroll in June's Course of the Month

June’s Course of the Month is now available! Experts Exchange’s Premium Members, Team Accounts, and Qualified Experts have access to a complimentary course each month as part of their membership—an extra way to sharpen your skills and increase training.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
An article on effective troubleshooting
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…

687 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question