ACL Order and Placement in a Three-VLAN Campus
A 1,200-employee manufacturer runs a /16 campus network on a core Layer 3 switch. VLAN 10 (clients, 10.20.10.0/24) and VLAN 20 (servers, 10.20.20.0/24) are routed; VLAN 30 (building management, 10.20.30.0/24) contains HVAC and badge controllers that must be reachable only from a jump host at 10.20.20.10. An ACL applied inbound on the VLAN 10 SVI contains: permit tcp any host 10.20.20.10 eq 443; permit ip 10.20.10.0 0.0.0.255 10.20.30.0 0.0.0.255; deny ip any 10.20.30.0 0.0.0.255; permit ip any any. A security review finds that a client at 10.20.10.77 can open a management session to the HVAC controller at 10.20.30.50, and a server at 10.20.20.25 can reach the badge controller. The team wants least privilege without breaking the jump-host workflow.
1. Identify the specific ACL and placement errors that allow the observed access. Explain the rule and packet path that permit each flow.
Read the worked answer
The client-to-HVAC flow is permitted by the second rule: permit ip 10.20.10.0 0.0.0.255 10.20.30.0 0.0.0.255. That rule matches all client VLAN traffic to the management subnet, including 10.20.10.77 to 10.20.30.50, before the later deny is evaluated. The deny is therefore unreachable for VLAN 10 sourced traffic. The third error is scope: the ACL is applied only inbound on the VLAN 10 SVI. There is no equivalent control on VLAN 20 or VLAN 30, so 10.20.20.25 can reach the badge controller simply because inter-VLAN routing is enabled and no filter blocks it. The final permit ip any any also makes the intent ambiguous and would allow other unintended flows. The design has both an order problem and a placement problem: a single inbound client ACL cannot enforce a management-zone policy for all sources.
2. Describe a corrected policy design: where should controls be applied, and what rules are required to enforce least privilege while preserving jump-host access?
Read the worked answer
Treat VLAN 30 as a protected zone and enforce policy as close to that zone as possible. On the Layer 3 switch, apply an inbound ACL on the VLAN 30 SVI that permits only the jump host 10.20.20.10 to the management subnet on the specific required ports, then denies all other traffic to 10.20.30.0/24. Also apply an inbound ACL on VLAN 10 that denies client-to-management traffic explicitly, while allowing client-to-jump-host access on the required remote-administration port. On VLAN 20, permit only 10.20.20.10 to management; do not permit the rest of the server subnet. If the platform supports stateful firewalling, place a firewall or security zone between VLANs rather than relying on stateless ACLs, because return traffic and ephemeral ports are easier to reason about. The jump-host workflow should be documented as a narrow exception, not a broad subnet permit.
3. How would you verify that the corrected policy works and monitor for future regressions?
Read the worked answer
Test from representative sources: 10.20.10.77 should fail to reach 10.20.30.50, 10.20.20.25 should fail to reach the badge controller, and 10.20.20.10 should succeed on only the approved ports. Test a denied flow and confirm the ACL hit counters increment on the expected rule. Enable logging on the deny rules, but rate-limit it to avoid log flooding. Export NetFlow or firewall logs from the management zone and alert on any new source that successfully reaches VLAN 30 outside the jump host. Add a configuration check to detect ACL edits that add broad permits before VLAN 30 or remove the jump-host restriction. Review the exception quarterly so a temporary workflow does not become a permanent broad rule.