So as we talked about,
we have edges that have transport interfaces and there's going to be an
implicit ACL. And that's via that concept of allow service,
whether we configure it at the UI or whether we configure it at the CLI,
either way, we see that we're allowing specific services.
And so that's the implicit ACL, which is already there.
But then I might want to add an explicit ACL,
which overrides the implicit.
And I might have a lot of reasons for doing this,
such as addressing protocols and port numbers that the implicit ACL and these
allowed service commands don't actually address.
Always remember the four services that are allowed by default,
which is DHCP, DNS, ICMP, and HTTPS.
Everything else is denied by default.
And so I need to go into my allowed service commands and make sure that I'm
allowing things like BGP. If I need to route with my service provider,
I could enable BGP. But if there is, again,
something that isn't listed there,
then that's what I would use an explicit ACL in order to accomplish.
As we talked about earlier,
the process for evaluating an overlap like this is going to be to look at the
explicit rules first,
then we look at the implicit rules,
and then we look at the explicit default action,
whatever that is, whether it's allowed or dropping traffic,
that is what we will do. And so we evaluate it in this order.
So it's always important for us to recognize what it is that we're trying to
accomplish,
and then make sure that we are structuring this in a way such that it
behaves like we want.
So what we want to do mostly in this is jump into the lab and we want to
verify our understanding of this and make sure that we see all of this in
action.
We're going to go ahead and create an explicit ACL and we're going to pay
attention to what the implicit ACL is doing on this transport interface.
So what I want to do is go ahead and create a rule that is for
denying ICMP traffic because ICMP is allowed by default.
If I deny it at this level and allow it at this
level, then evaluating it in this way, we see that it should get denied.
Then we're also going to change the default action to allow.
And the reason for this, write it over here,
we're going to allow by default.
The reason for this is because I want to test SSH communication.
SSH is one of these that could be configured on the implicit,
but it's by default disabled and it's still disabled in our lab environment.
And so if for any reason this was evaluated
up here, which in this case, now we're talking about SSH.
So SSH is getting denied at both of these levels,
actually, because the explicit rules don't include it.
The implicit rules deny it.
But if this was happening in here, then it would be allowed.
So only if it's happening at the end, will SSH continue to be rejected.
So we're going to create an explicit ACL like this.
We know how to configure AXS control lists.
And then we're going to apply this to an interface
Specifically, we're going to apply it to Edge 11,
the transport interface for BizInternet.
And because BizInternet has connectivity,
remember, this is the 192.168.255.0 slash 24 subnet.
And so we've got connectivity over here to Edge 13.
We'll get on to Edge 13.
We'll try to do a ping and we'll try to do an SSH.
And we'll validate what we think is going to happen,
which is that neither of these should end up working.
The pinging should get rejected by our explicit ACL and SSH should get rejected
by the implicit ACL before our default action of allow applies.
So before we do that configuration, let's just get into the lab environment
and verify that things are working like we think.
So I should be able to ping, for example, that 255.11 for Edge 11.
And I can ping it, which means that the ICMP is currently being allowed.
And if I were to SSH, let's say using the username Cisco into 192.168.255.11,
I should get no response.
So I'm not even getting prompted and denied or anything like that.
I'm just not getting anything, which tells me that the implicit ACL is doing its job.
It's allowing ICMP through and it's rejecting our SSH.
So now let's flip over to SD-WAN Manager and do our configuration.
So we're going to go to configuration and go all the way down to policies.
Let's go ahead and configure this in a slightly different order.
Just for the sake of demoing something different,
we're going to come up here to custom options,
go to our access control list here under localized,
and I can add an access control list here.
So we've got our other access control list we just created, this web blocking one.
But I'm going to, whoops, right here,
I'm going to go ahead and create an access control list.
And we're going to call this overlap underscore ACL.
And the description is it's an ACL for implicit overlap.
You're going to overlap the implicit with an explicit.
So we're going to add an ACL sequence, get our sequence rule out here.
And so what are we going to match?
Well, first of all, how do I do ICMP matching?
Let's go ahead and block ICMP.
And really that's the only thing we're going to do.
We're going to block ICMP and then change the default action.
So how do I match on ICMP?
I don't see ICMP up here.
Well, the best way to do that is by selecting protocol and entering protocol
number one, because that's what ICMP is.
Here's the good news.
Cisco kind of validates for us that we got it right because as soon as I
entered one, if I had entered, let's say 22 for SSH, I don't get a pop-up down here.
But if I enter one that says, oh, you want to block ICMP, which message do you want
to type? Do you want to block?
So I can type in echo, for example, in here to look at all the echoes and I can just
flat out block an echo.
Whoops, not reply, but an echo request.
Let's go and get rid of the reply there.
There we go.
So we can request requests.
We can block the echo request from entering into this interface.
Our action here, it says to accept.
We want to change that.
So scroll back up to actions and say we're going to drop this.
And if we wanted to log it, then we could.
So we might as well.
So we've got our ICMP blocking in place.
But again, we want to also go to default action and allow everything.
So the default, default action, the default, default, the default configuration for our
default action is to drop it.
So I'm going to change it to accept, save it.
And now we should be good.
We should be dropping our echo requests and we should be allowing everything else.
So I'm going to scroll down and save our access control list policy.
And again, remember, I came up here to access control lists.
This is just a list of access control lists, just a list of ACLs that I can apply to a
policy.
I haven't created the policy yet.
So let's go ahead and do that.
I'm going to come back to localized policy or I could do it this way.
However I want to get here, but I'm on my localized policies.
We're going to add a policy.
I don't need to configure any new groups of interest.
So I'm going to click next and we don't need to do anything with quality of service.
But under access control list, now I can add my access control list here.
Now, keep in mind, I could create a new one, but I already created it.
Or maybe I want to apply one that I've created for another policy.
So I can just say import existing.
And this is where that list of ACLs shows up.
So I can do my web block ACL.
I can do my overlap ACL.
And by the way, this is why it's important to have the word ACL inside of your name.
Maybe I'd recommend trying to standardize whether it goes at the front of the name or
at the back of the name.
I didn't do a good job of that.
But having it in here helps us to identify what is a policy versus what is an ACL.
And as we saw earlier, we're going to have to go apply this.
When we go to apply it, we actually have to type in the name of the ACL.
And so the more memorable we can make it, the better.
So I'm going to pick overlap underscore ACL here and click import.
And it shows up in the list just like it did before when we made it.
It just puts it right in, says that it was imported.
So next, we're going to finish this out, skip the route policy, and we're going to
need to give this a name.
So I'm going to call this just some kind of implicit override policy.
And this is a policy with an access control list to override the implicit.
OK, so we're just going to save policy.
We don't need to worry about any of the other options.
And now we need to go apply it.
So this is always the tricky part of access control lists.
If you can remember this process, then you're in really good shape.
But recall that what we do is we go to templates under configuration, and we've
got to do this in two different areas.
We've got to do this in the device and feature templates.
So I'll go ahead and start with the device template here.
I'm going to find my lab edge template here.
This template's for the controller.
By the way, it says it right here, controller versus an edge.
So I'm going to edit this.
And we're going to scroll down, or I guess we could click additional templates here.
And remember, we've got this other policy attached.
I'm going to go and change this policy to the implicit override policy and update that.
So now we're going to get that other access control list pushed down.
I can look at the config diff if I want to, just to make sure that we're getting it.
Oops, we got a server error.
That's interesting.
Try it again real quick.
Ah, OK.
So something's up there.
That's fine.
We'll just go ahead and push the configuration and let's hope it goes through.
And it failed.
And it looks like we have our reason.
It's because our feature template's referencing an ACL that's not actually going to be configured anymore.
So let's go ahead and come over here to feature template.
And we need to pull this off of our gig three interface.
Because it is referencing, again, an ACL that's no longer going to be added.
The alternative is we could actually add that ACL into this policy and then the problem would resolve itself.
But at this point, rather than editing the policy, this is just our lab environment after all, we'll just go ahead and take care of it this way.
So we're going to go ahead and change this.
Actually, we're just going to turn it to off.
In fact, we'll just set it to the default, which is off.
And we'll update this and it will push this out to our two devices.
And once that's done, then we'll go back to the device template and push that out.
All right.
And that was successful.
So let's go ahead and go back here.
I'm going to now do what we did before, edit our device template, go to additional templates, change it to the implicit override policy.
And at this point, we should be able, let's see if it actually goes through this time.
And it looks like it did.
So I can scroll down and see that we are just getting rid of, well, first of all, the prefix list we're no longer using.
Again, it cleans things up, which is wonderful.
Creates the new access list.
And then it's going to say that it's going to log in.
But that's all we're doing.
Remember, we're just creating a policy that has an access control list in it.
We're not actually applying it yet.
So let's go ahead and push that out.
And it looks like that is going through.
And so once it's done, then we can go apply it to the interface.
All right.
So it's done.
It worked.
That's great.
Let's go to the feature templates now.
Now, remember, we're applying this not to the same interface we just applied it.
That was VPN 10 on the service side.
We want to apply this to the biz internet interface.
I don't know why I said internet twice.
Biz internet interface, whatever.
All right.
So we're going to go in here and edit this.
And now we're going to scroll up to that ACL section.
Same thing.
We're going to say global on, and I'm going to push this access control list.
So what did we call it?
We called it the overlap underscore ACL.
This is why it's so important to remember what it is that we called things.
So I'm going to click update now.
And that it was, by the way, an inbound.
We're going to make sure it's the right direction, but we did apply it to the
inbound ACL, and so now we can take a look at this, see what exactly it's going to do.
Click config diff, scroll down, and we should see right there, it's going to
apply it to our interface gig one, which is our biz internet interface right there.
Perfect.
All right, let's go ahead and configure these devices.
It is pushing it out to edges 11 and 12.
Again, it's a lab environment, so we're just kind of doing a demo here, but the
idea is that we would definitely want to control where we're pushing this out
and be very granular if needed.
We could always use device specific config rather than global if we so
desired there in the feature template.
So once this is applied, we'll switch over to the CLI and
confirm it's in place and then verify.
All right, let's go ahead and switch over.
So let's go ahead and take a look quickly at the configuration.
And so we do see that we've got this overlap ACL configured and the default
action is accept while we are matching protocol one ICMP message echo
specifically, and we are dropping our pings.
So from here I can go up to the interface, interface gig one here, gig one.
And we've got the full tunnel interface configuration here.
So this is our implicit ACL configuration is all right here.
But outside of the tunnel interface notice is where the access control
list for our overlap is placed.
So that is good to go.
Let's go and flip back over to edge 13 and we have been logged
out from a timing perspective.
And so let's go ahead and ping 192.168.255.11.
This worked before, by the way.
And it looks like this is the one time when you're doing a demo and
it's not supposed to go through.
It's the one time you celebrate when you see the dots instead
of the exclamation points.
But yes, we were good.
We actually did not want to see the ping response there.
And then I can do that SSH into this device as well.
And we're going to find that there's no response there.
So again, keep in mind, we changed the explicit default to allow.
So if the implicit ACL was no longer doing anything, this would have worked.
We would have seen an SSH session, but because we're still being
And so then the question that you have to ask is whether
the tunnels are still up.
I'm not, we had, there we go.
All right.
Wasn't responding to my cancel out.
So let's go and do a show SD-WAN BFD sessions.
And this will tell us whether we have tunnels to 11 and indeed we do.
So we've still got that restriction in place where 11 is the hub.
We did a custom topology.
So I don't see the tunnels to edge 12, for example.
But even though I can't ping edge 11, I'm still forming tunnels
because I'm only blocking the ping.
I'm not blocking all of the traffic.
So this was a good way to validate that that explicit rules, implicit
rules, and then explicit default action is evaluated in that order.
Just make sure that we understand that and that we can manipulate
access control lists in order to allow whatever traffic through that
we want, whether that's by changing the explicit ACL or if it's on a
transport interface by changing the implicit ACL or potentially
a combination of both.