Allow access from PC only to one IP address

Dear Experts,

We have a monitoring PC [vendor supplied - WinXP] for our SAN on our network. The PC has LogMeIn installed so the remote techs can access the PC and thus the SAN if an alert is triggered.

The goal is to configure the PC so they only have access to the SAN [single IP address] and not the rest of our network. It's not my PC so I'm somewhat limited on what I can do. I'm kind of looking for something that would work like an ACL, allow traffic from only this source IP to this destination IP.

The PC is connected to a Cisco 2980 layer 2 switch.

Would the route table on the PC be able to do what I need?
Can a layer 2 switch handle an ACL like this?

TIA,

Mike
ENCLAsked:
Who is Participating?
 
John MeggersConnect With a Mentor Network ArchitectCommented:
I'm not familiar with the 2980, but the only one I see was EOL back in 2004, and has been out of support since 2009.  From what I read, it sounds like it's layer 2 only, but even so you should still be able to do a MAC ACL. The challenge is the correct syntax for it.  If you can find out what image you're running that would help.  

On current switches, the syntax typically looks something like what's below, but there's no guarantee this will work on your switch:

mac access-list extended MAC-Test
 permit host 1234.5678.9012 host 7890.1234.5678

interface fa1/0/10
mac access-group MAC-Test in
0
 
JohnnyITCommented:
While I'm not certain on how exactly, I believe this can be achieved by adjusting the routing table on the PC.

In a cmd prompt, type "Route Print"  Somewhere about the middle of the output, you'll see a line like this:

    192.168.1.0    255.255.255.0     192.168.1.95    192.168.1.95       20

"192.168.1.0" being the entire subnet, and "192.168.1.95" being the IP of the computer you're working on.

If you change the "0" to the IP of the SAN, that might work.  (I've never tried this though)




Alternatively, if you have security software installed, you can use the firewall to simply block traffic to everything except logmein and the SAN. Then password-protect the software.



Alternatively, does the SAN support multiple IP's??  If so, give it another IP on a different subnet, then set the monitoring PC to that same subnet.  (although that doesn't guarantee anything)


0
 
ENCLAuthor Commented:
Hi Guys,

Thanks for the ideas, I'm going to try the MAC address ACL, this would be the most secure method for us. Plus, the remote tech could potential change the local route table if he knew how. I'll test later today or tomorrow and provide some feedback.

Regards,

Mike
0
 
ENCLAuthor Commented:
Thanks for the help.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.