switching ACL help

[pirateclem]

At my location I have a 4506/4507 pair at the core and 3550 edge switches. I have a client on one particular port which has a static IP. I would like to keep this client from running a network scanner. I cannot control what is installed on the client, it is in my network and has routes to everything. I figured if I could keep this client from passing SNMP and ICMP this will not be a problem. The 3550 that this clients port is on has a basic ACL configured which allows all traffic it this clients subnet to be passed. ie:
basic acl 10
10 permit 10.1.1.0 0.0.0.255 any any

So, if I put an extended ACL on to keep this one client from doing something it will not matter since extended acl's begin at 100...correct?

extended acl 100
10 deny tcp 10.1.1.5 0.0.0.0 eq snmp

Basicaly no good right? What else can I do? Can I limit traffic at the core switches? Routing between multiple VLAN's at the cores. Input?

 

[pirateclem]

I have not needed ACL's on my edge switches before. Guess I was confused. Set up the acl today and figured out that I could apply it to a specific port. Anyone have an idea which protocols need to be blocked to stop a network scanner?

 

[NetworksMD]

Your best bet would be to deny this host everything first and then open up only the network resources it needs.

 

[voltron1011]

What services does the user need? Find out what he actually needs to do his job (I.E. www, telnet, ftp, etc) and then deny everything else. then apply that list as OUTBOUND access-group on his interface.

access-list 101 permit tcp host x.x.x.x to any eq www
access-list 101 permit tcp host x.x.x.x to any eq ftp
access-list 101 deny ip any any

 

[pirateclem]

I spoke with Cisco today and the engineer stated that I had to apply the ACL to the VLAN interface that this client was a member of rather than to the port that the client is connected to. Does this sound right? I thought I could put an ACL on anything given: a.) Thing to apply the access list (group) to b.)the access list c.)the direction it is applied in. Input? I really thought I could make the access list say: access-list extended 100. Then apply it as access-group 100 in to fa 0/1 for instance. If I have the IP address correct for that client then the described traffic would not be able to enter that port on the switch from that client. Nip it in the bud rather than at the VLAN level. Am I right or wrong?

 

[voltron1011]

Actually, they are right.. You can't apply an access-group to a switched interface, only a routed interface. You can apply it to vlan interface as an outbound list.

 

[pirateclem]

Ah. Well the switch let me apply it, thats probably where I got confused. So do I apply it to VLAN X as an access group on the edge switch or in one of the cores? VLAN 90 can be an interface on the edge but will it work right?

 

[voltron1011]

Apply it to whatever device the actual VLAN is configured on.