Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 441
  • Last Modified:

Allow access from PC only to one IP address

Dear Experts,

We have a monitoring PC [vendor supplied - WinXP] for our SAN on our network. The PC has LogMeIn installed so the remote techs can access the PC and thus the SAN if an alert is triggered.

The goal is to configure the PC so they only have access to the SAN [single IP address] and not the rest of our network. It's not my PC so I'm somewhat limited on what I can do. I'm kind of looking for something that would work like an ACL, allow traffic from only this source IP to this destination IP.

The PC is connected to a Cisco 2980 layer 2 switch.

Would the route table on the PC be able to do what I need?
Can a layer 2 switch handle an ACL like this?

TIA,

Mike
0
ENCL
Asked:
ENCL
  • 2
1 Solution
 
jmeggersSr. Network and Security EngineerCommented:
I'm not familiar with the 2980, but the only one I see was EOL back in 2004, and has been out of support since 2009.  From what I read, it sounds like it's layer 2 only, but even so you should still be able to do a MAC ACL. The challenge is the correct syntax for it.  If you can find out what image you're running that would help.  

On current switches, the syntax typically looks something like what's below, but there's no guarantee this will work on your switch:

mac access-list extended MAC-Test
 permit host 1234.5678.9012 host 7890.1234.5678

interface fa1/0/10
mac access-group MAC-Test in
0
 
JohnnyITCommented:
While I'm not certain on how exactly, I believe this can be achieved by adjusting the routing table on the PC.

In a cmd prompt, type "Route Print"  Somewhere about the middle of the output, you'll see a line like this:

    192.168.1.0    255.255.255.0     192.168.1.95    192.168.1.95       20

"192.168.1.0" being the entire subnet, and "192.168.1.95" being the IP of the computer you're working on.

If you change the "0" to the IP of the SAN, that might work.  (I've never tried this though)




Alternatively, if you have security software installed, you can use the firewall to simply block traffic to everything except logmein and the SAN. Then password-protect the software.



Alternatively, does the SAN support multiple IP's??  If so, give it another IP on a different subnet, then set the monitoring PC to that same subnet.  (although that doesn't guarantee anything)


0
 
ENCLAuthor Commented:
Hi Guys,

Thanks for the ideas, I'm going to try the MAC address ACL, this would be the most secure method for us. Plus, the remote tech could potential change the local route table if he knew how. I'll test later today or tomorrow and provide some feedback.

Regards,

Mike
0
 
ENCLAuthor Commented:
Thanks for the help.
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now