Procedure
1.
Configure an ACE that specifically permits authorized traffic from the remote network.
2.
Configure narrowly defined ACEs to block unwanted IP traffic that would otherwise use the gateway; such
ACEs might deny traffic for a particular application, particular hosts, or an entire subnet.
3.
Configure a "permit any" ACE to specifically allow any IP traffic to move through the gateway.
ACE blocking an entire subnet
switch(config)# access-list config
ip access-list extended "101"
deny ip 0.0.0.0 255.255.255.255 10.0.8.30 0.0.0.255
permit ip 0.0.0.0 255.255.255.255 0.0.0.00 255.255.255.255
exit
Local gateway case
If you use the switch as a gateway for traffic you want routed between subnets, use these general steps to avoid
blocking the gateway for authorized applications:
Procedure
1.
Configure gateway security first for routing with specific permit and deny statements.
2.
Permit authorized traffic.
3.
Deny any unauthorized traffic that you have not already denied in step
IGMP-related problems
IP multicast (IGMP) traffic that is directed by IGMP does not reach IGMP hosts or a
multicast router connected to a port
IGMP must be enabled on the switch and the affected port must be configured for "Auto" or "Forward" operation.
IP multicast traffic floods out all ports; IGMP does not appear to filter traffic
The IGMP feature does not operate if the switch or VLAN does not have an IP address configured manually or
obtained through DHCP/Bootp. To verify whether an IP address is configured for the switch or VLAN, do one of
the following:
•
Try using the WebAgent
: If you can access the WebAgent, then an IP address is configured.
•
Try to telnet to the switch console
: If you can Telnet to the switch, an IP address is configured.
•
Use the switch console interface
: From the Main Menu, check the Management Address Information screen
by clicking on:
1. Status and Counters
2. Switch Management Address Information
LACP-related problems
464
Aruba 2930F / 2930M Management and Configuration Guide
for ArubaOS-Switch 16.08
