WCCP Deny and permit ACL on 3750

Hi everyone,
I have configured 3750 switch as WCCP.
I am redirecting only inside traffic.
Switch has direct connection to Mcafee Gateway.
Our internal LAN subnets are 172.16.x.x and 192.168.0.0.
Need to confirm if i want internal users to access the internet then under permit ACL i can say
permit 172.16.0.0 to any?
If i want some users traffic should not be redirected to Mcafee gateway then i can say
deny 172.16.10.10 any?
Regards
MAhesh

Hi Reuben,
Yes IOS version is higher than 12.2(58)SE.
Thanks for reply.
Regards
MAhesh

Similar Messages

Need differentiated support for "deny" vs "permit" in NX-OS QoS ACLs

Does anyone know if a later version of NX-OS will be able to differentiate between "deny" vs "permit" in NX-OS QoS ACLs? The NX-OS QoS documentation states that the permit and deny keywords are ignored for the purposes of matching in QoS class-maps.
Here is the recent Cisco references.
http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/qos/configuration/guide/classification.html#wp1124010
and
http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/qos/513_n2_1/b_Cisco_Nexus_5000_QoS_Config_Guide_513_N2_1_chapter_010.html#task_1135158
I tested the N7K, and it does indeed ignore the
permit and deny keywords. (DIscussion here, if you are interested...Deny Equals Permit in NX-OS QoS ACLs
The impact - for QoS class-maps, both the deny and permit statements in the example below are matched:
ip access-list test
permit any 10.0.1.0 0.0.0.255
deny ip any any
This behavior does not follow what happens on 6500s and other IOS devices.

Jerry -
Any idea why? This breaks the ability to use moderately complex ACLs. For example - how would you configure scavenger class traffic to ignore some traffic, and mark other?
Carole

EJB ACLs and permissions, help needed urgently

Hello,
I am using WL6.1. I need to use weblogic.security.acl.Security.checkPermission
to check if a user has permission to acess an EJB method. I know one can call
the method and check the exception to see yes or no. But that requires knowing
the method signature (parameters and return types etc.).
I read the documentation and here is what I got:
ACLs and permissions for WebLogic EJBs differ from ACLs and permissions for other
kinds of WebLogic Server resources in the following ways:
1. EJB ACLs are configured in the access control properties of the EJB's deployment
descriptor.
2. Permissions are granted on individual methods of a bean; there are no predefined
permissions.
3. Permissions on EJBs are granted to Roles, which map to groups in WebLogic Server.
So if I read it correctly:
1. One does not need to use WL console to configure EJB ACLs? If otherwise, how
do we do it?. There is no documentation for it.
2. What is the ACLName to use when I call the method weblogic.security.acl.Security.checkPermission(java.security.Principal
principal, java.lang.String aclName,
java.security.acl.Permission permission,
char sep)?
I tried with JNDI name and EJB name and nothing seems to work.
Can anyone help me out?
Thanks.
Ling Wang

It all depends on where do you want to keep your ACLs and the rest of security.
Simplest will be fileRealm, but it has limited capability (10k ACLs I recall).
You do not heed console to set it up. Here is an excert from ACL file:
acl.read.OT_INTEGRATIONOBJREF=everyone
acl.read.OT_ORGTRANSPORT=OrgAdmin,AppAdmin
acl.read.OT_ORGUNITOFMEASURE=OrgAdmin,AppAdmin
# from nonWorkflowEvents.template
acl.execute.ET_QUERY=everyone
acl.execute.ET_BATCH=everyone
read/execute is action. Caps keep resource (name). On the right hand is a list
of roles. The security call will be lokking like:
boolean result = Security.hasPermission("ET_BATCH",
new PermissionImpl("read"), '.');
It does not throw, just returns a boolean.
Now, this is all about programmatic security. If you are up to declarative, you
need to assign role names to method names in deployment descriptor of your bean
and map them to actual roles.
Also you may have problems while asking security question about another principal
(nto the one currently logged in). Not that it does not work -- just needs caution.
Hope it helps.
"Ling Wang" <[email protected]> wrote:
>
Hello,
I am using WL6.1. I need to use weblogic.security.acl.Security.checkPermission
to check if a user has permission to acess an EJB method. I know one
can call
the method and check the exception to see yes or no. But that requires
knowing
the method signature (parameters and return types etc.).
I read the documentation and here is what I got:
ACLs and permissions for WebLogic EJBs differ from ACLs and permissions
for other
kinds of WebLogic Server resources in the following ways:
1. EJB ACLs are configured in the access control properties of the EJB's
deployment
descriptor.
2. Permissions are granted on individual methods of a bean; there are
no predefined
permissions.
3. Permissions on EJBs are granted to Roles, which map to groups in WebLogic
Server.
So if I read it correctly:
1. One does not need to use WL console to configure EJB ACLs? If otherwise,
how
do we do it?. There is no documentation for it.
2. What is the ACLName to use when I call the method weblogic.security.acl.Security.checkPermission(java.security.Principal
principal, java.lang.String aclName,
java.security.acl.Permission permission,
char sep)?
I tried with JNDI name and EJB name and nothing seems to work.
Can anyone help me out?
Thanks.
Ling Wang

UME: Regular Permissions - ACL Permissions

Gentelmen,
After reading recently published SDN article about WD security (Aug 31, 2004 -- https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sapportals.km.docs/documents/a1-8-4/web dynpro security.pdf), one question araise for me: what is a connection (if any) between regular UME permissions (in fact, std. java permissions) and UME ACL permission?
Any thoughts?
VS

[ -closed with no resolution- ]

Permissions/ACL reporting

Hi,
Does anyone know of any software that will produce a report of a file system tree along with the permissions attached to each directory within the tree?
Cheers,
Stu

OK
So I misread on the your instructions about the PW reset, did it, no harm in that. I did also select the options to reset all the permissions for all the accounts and the ACL issues were not resolved. My bad, I forgot to note that.
You do suggest getting and expert opinion but alas these are rather elusive. In most cases the Apple solutions is to do a complete reinstall... I have found that unless you completely wipe a drive and rebuild everything there are often artifacts left behind. Since I have full and redundant back-ups I would rather explore and hack a little instead of a dull old system reinstall. The irony is the system issue I had was it was the result a reinstall and combo update on a new drive. I recognize the risks of entering the realms of the System folders but I am willing to explore knowing full well that I have a path to recovery.
Thanks again for your insights. I come to the forums looking for insights and ideas but not a lecture...

User Level permissions (ACLs) - HOW?

Dear Expert,
One more victim of Mackeeper writing to you seeking help...
I tried my best to remove it from the comp and I have succeded.
However, I am stuck at 2 points:
1) How User Level permissions (ACLs)? Please guide....
2) Mackeeper keeps opening pages in safari on its own, whenever I open a new tab. Please GUIDE.
Please help.....
Look forward to receiving valuable inputs.
Regards,
Sony Thadani

There is no need to download anything to solve this problem.
You may have installed the "Downlite" or "VSearch" ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have an adware variant not covered by the support article. Ask for instructions in that case.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This malware is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates
if it's not already checked.

Deny Alter permissions to a table

Hello,
I want to deny alter permissions and permissions to insert, update and delete to a specific table to the users in our team. All the users should have only the select permission. I am using the statement for denying the delete permissions as
DENY DELETE ON OBJECT::dbo.Table_To_Deny TO ABCD\UserName;
This is throwing an error as Incorrect syntax near '\'. I also tried just by putting username but no luck. I have no option to put the table in seperate readonly database.
Please help.
Thanks

Why DENY? Users don't have permissions until you grant them. Just don't grant these users permissions to do things they shouldn't do.
Your syntax is invalid because of the '\', exactly as the error states. The deny would look something like
deny delete on [SchemaName].[TableName] to [userName]
David
David http://blogs.msdn.com/b/dbrowne/

ACL Applied in Inbound direction and another ACL exist for in outbound direction - will return traffic allow

interface gix/y
ip address A.B.C.D 255.255.255.192
ip access-group ACL-Inbound in
ip access-group ACL-Outbound out
exit
In ACL-Inbound I have allowed SMTP traffic 6 source address to 4 destination server. One sample output among 24 acl is given below.
permit tcp host E.F.G.H host I.J.K.L eq 25
I haven't applied any specific rule for SMTP traffic on outbound direction. My understanding is destinations will be able to reply to the request. Does that need to be specified in the ACL

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
As Fahad has already noted, if you're going to use both an in and out ACL, you'll need to account for the traffic allowed in both direction. Normally, the in and out ACE are just mirror entries, so for your example of:
in
permit tcp host E.F.G.H host I.J.K.L eq 25
out would be:
permit tcp host I.J.K.L eq 25 host E.F.G.H
Fahad also mentioned using a Reflexive ACL. These will generate a stateful mirror ACE for the reverse traffic. The reverse ACE will stay active for a short duration after seeing traffic that creates it and the it will time out and remove itself. Normally you would only use one on a trusted side of the device for generated flows. When used with a trusted side, the ACE often are made more generic, for example, any inside to outside HTTP flow will allow and ACE for the return traffic.

I want to change the sharing and permissions of a large number of photos. How can I do this in bulk rather than one at a time?

I want to change the sharing and permissions of a large number of photos. How can I do this in bulk rather than one at a time?

Does this involve iPhoto in some way?

SharePoint 2013 - Site Settings - Users and permissions - "Access Request and invitations" link missing

I am site collection administrator and have configured the outgoing email in Central administration but "Access Request and invitations" link is missing, pl advice any additional configurations for this link to show up
I was though able to configure access requests by going to Site Settings->Users and permission and on the ribbon selected "Access Request Settings"
What is the difference in either of the approaches?
Thanks
Abhishek

Hi there,
I noticed this post, and didnt really find an appropriate solution to your issue. I noticed the same issue when dealing with Access Requests. First of all to make sure that the Request feature is enabled, you need to access
Site Settings -> Site Permissions -> Access Request Settings -> Make sure the
'Allow access requests' option is enabled.
The Allow access screen just allows you to enable the feature and also to specify a email address that notifications are sent to. Whereas the 'Access Requests and Invitations' section provides a screen to manage Access Requests and request history.
I noticed then that the Access Requests and Invitations link under 'User and Permissions' didnt actually appear until someone actually requests to join the site. It seems that this is needed to display the screen. Once actioned once, the option stays there.
Hope it helps

Unable to download from AppStore, updates,etc.Messages 'the installer is damaged' to 'there might be a problem with file ownership and permissions.' I am the owner and only user of a new MBP. What could be going on?

Is anyone having the same type of problems I'm having with Lion. I have a new MacBook Pro, received 7 weeks ago, preinstalled with Leopard 10.6.7. I didn't migrate anything from my old iMac, wanted a clean install from the Apple Store. While there, I asked for the upgrade to Lion 10.7, however their system was down.
I installed it myself, wirelessly about a week later, and Apple emailed me a receipt. Now, I've had to call support directly last week when I lost Mail, Address Book, was unable to open Preview or iTunes, among other problems. Seemed fixed after a session that baffled even the store tech. Now I am unable to download or install the recent Mac updates for Lion, from the App Store, could not install Adobe Reader, etc. Messages range from 'A network error has occured - Check your Internet connection and try again' to 'The Installer is damaged and cannot open the package. There may be a problem with file ownership or permissions.' All fail and I'll probably have to call Apple again. I am frustrated beyond words. Logs 'Install's runner tool is not properly configured as a setuid tool', domain errors, 'attempt to write a readonly database, and on and on. I have barely done a thing on this computer except search online for help with these problems. Safari gives me a 'You are not connected to the internet' too often. Diagnostics disagrees. I do see wi-fi problems in the forum. Disk and permissions were fine at the beginning of the earlier problems, checked first by support tech. I'm not sure if support tech even knew. I was just happy they were fixed. Anyone have these download and/or install problems after a 'clean bill of health' so to speak, only a week ago?

Let's try the following user tip with that one:
"There is a problem with this Windows Installer package ..." error messages when installing iTunes for Windows

DANGER: Do Not Change Hard Drive Ownership and Permissions

DANGER: Do Not Change Hard Drive Ownership and Permissions (Unless you know what you are doing... I didn't!)
FIRST, THE REPAIR PERMISSIONS SOLUTION:
Use Disk Utilities on the "Sofware Install and Restore" DVD that came with your computer to set the permissions back to the defaults. Not the MacOSX Installation Disk. (This worked in MacOS 10.3.9)
MY SCREW UP
In my Hard Drive's "Get Info" dialog I switched the permissions of the Owner to my username and all others to no access. I had not yet closed the dialog and decided that it was probably dangerous so I started changing them back. I first changed the owner back to system. It asked for authentication.
After entering my password I assumed that I would be able to go back and change the others as well. Nope! The dialog disappeared, my desktop disappeared and I couldn't do anything. I was locked out.
After ten minutes of the beachball I restarted to the "Panther Installation disk" and tried repairing permissioins using disk utility. Evertime it "lost contact" with the system and would not work. Restarting (without CD) took me to a root user login (black sreen). My username and password did nothing.
THE SOLUTION
I then restarted to the "Software Install and Restore" DVD that came with my computer and used its Disk Utility to repair permissions. IT WORKED! It set permissions back to the default. THANK GOD.
NOTE: I wonder, will using the Install and Restore DVD to repair permissions reset any computer's files to the defaults? Is that a backdoor into someones currently restricted files and folders? (Assuming that you have physical access and the computer specific DVD)

Using the Repair Permissions function will not change the permissions on an account's home folder or anything in it, but there are at least two other ways in which someone with a Mac OS X 10.4 installation disk can get access to an account's files or folders unless some or all of those files are encrypted.
(19285)

Org.clamav.freshclam and permissions error on freshclam.log

This is an adjunct to a branched discussion in this thread regarding org.clamav.freshclam continually generating error reports in the system log.
After enabling, but not starting, Mail service on my server (XServe Dual-G5, 10.5.8 Server) my system log began filling with the error as per the referenced thread. The first entry when the error cropped up was:
Nov 5 15:23:20 xserve1 com.apple.launchd[1] (org.clamav.freshclam): Unknown key for integer: Iterations
Nov 5 15:23:20 xserve1 org.clamav.freshclam[40472]: ERROR: Incorrect argument format for option --checks (-c)
Nov 5 15:23:20 xserve1 org.clamav.freshclam[40472]: ERROR: Can't parse command line options
Nov 5 15:23:20 xserve1 com.apple.launchd[1] (org.clamav.freshclam[40472]): Exited with exit code: 1
Nov 5 15:23:20 xserve1 com.apple.launchd[1] (org.clamav.freshclam): Throttling respawn: Will start in 10 seconds
Per the instructions in the referenced thread, I ran
launchctl unload /System/Library/LaunchDaemons/org.clamav.freshclam.plist
I then used pico to edit the org.clamav.freshclamplist file, removing the space between the '-c' and value in the line:
<string>-c 4</string>
I also edited the /etc/freshclam.conf file to change the value:
#DatabaseMirror db.XY.clamav.net
to
DatabaseMirror db.us.clamav.net
I then ran
freshclam -v
followed by
launchctl load /System/Library/LaunchDaemons/org.clamav.freshclam.plist
Checking the log again, not only had the original error continued whilst I was editing, but also on the relaunch of freshclam a new error cropped up:
Nov 7 08:35:39 xserve1 com.apple.launchd[127] (org.clamav.freshclam): Unknown key for integer: Iterations
Nov 7 08:35:39 xserve1 com.apple.launchd[127] (org.clamav.freshclam): Ignored this key: UserName
*Nov 7 08:35:39 xserve1 org.clamav.freshclam[474]: ERROR: Problem with internal logger (UpdateLogFile = /var/log/freshclam.log).*
*Nov 7 08:35:39 xserve1 org.clamav.freshclam[474]: ERROR: Can't open /var/log/freshclam.log in append mode (check permissions!).*
Nov 7 08:35:39 xserve1 com.apple.launchd[127] (org.clamav.freshclam[474]): Exited with exit code: 62
Nov 7 08:35:39 xserve1 com.apple.launchd[127] (org.clamav.freshclam): Throttling respawn: Will start in 10 seconds
Nov 7 08:35:48 xserve1 org.clamav.freshclam[475]: ERROR: Incorrect argument format for option --checks (-c)
Nov 7 08:35:48 xserve1 org.clamav.freshclam[475]: ERROR: Can't parse command line options
Nov 7 08:35:48 xserve1 com.apple.launchd[1] (org.clamav.freshclam[475]): Exited with exit code: 1
Nov 7 08:35:48 xserve1 com.apple.launchd[1] (org.clamav.freshclam): Throttling respawn: Will start in 10 seconds
Nov 7 08:35:49 xserve1 org.clamav.freshclam[476]: ERROR: Problem with internal logger (UpdateLogFile = /var/log/freshclam.log).
Nov 7 08:35:49 xserve1 org.clamav.freshclam[476]: ERROR: Can't open /var/log/freshclam.log in append mode (check permissions!).
Nov 7 08:35:49 xserve1 com.apple.launchd[127] (org.clamav.freshclam[476]): Exited with exit code: 62
Nov 7 08:35:49 xserve1 com.apple.launchd[127] (org.clamav.freshclam): Throttling respawn: Will start in 10 seconds
(Note: after the first 'Exited with exit code: 1' entry, it only repeated the last four lines as above as it respawned.)
Checking the ownership / permissions on the freshclam.log file showed that the owner/goup was _clamav:admin and the permisions were -rw-r----- which is proper and in line with the other clamav files in the directory. Thinking that perhaps the logfile was corrupted, I deleted it and made a new one, setting the owner, group and permissions as per the original. The log errors continued.
Finally, in desparation, I ran
chmod 660 /var/log/freshclam.log
setting the permissions to -rw-rw---- and the errors ceased!
Now, this is not proper file permissions nor does it explain why freshclam suddenly could not append the logfile, but freshclam is now happily churning away without generating continuous log error entries. For the moment, I am not going to argue with successful results!
-Doug

Hi Fred,
interesting.. but I'm of the mind "If it ain't broke.." and it has been running without problem since applying the fix. I may end up having to migrate Mail services to a different server soon though, so I'll keep it in mind if the error crops up again. Thanks for the tip!
-Doug

Can't use Ikea Home Planner because of Sharing and Permissions on plug-in

I'm not sure where to submit this, or if the Apple support community cares, but I swear there's an answer to this. I am on a Macbook Air using Lion 10.7.2
When I download the "NP_2020Player_IKEA.plugin" downloadable from this website http://kitchenplanner.ikea.com/AU/UI/Pages/VPUI.htm and try to mount the plug-in I get these errors...
1. letting me know that the Ikea plug-in can't be moved because internet plug-ins can't be modified. So I click "Authenticate".
2. Then I "Replace" and after this selection it's asks for the Administrator's password, and I give it.
3. I follow the directions of this prompt, but am unable to change all of the permissions to "Read and Write"..
4.Here is a screenshot of the "Get Info" window for the plug-in.
I am unable to change "staff" and "everyone" to "Read & Write".
So I just ignore it and restart Safari, hoping it will work. When I return to the Home Planner main page it automatically directs me to the download page again, prompting me to download the plug-in. From what I've read it should just open the home planner. I'm assuming it's because the plug-in was never mounted because I can't allow the sharing and permissions? I don't really know a lot about computers, can someone help? I know a lot of other people have had issues with this planner download, but I haven't found any answers about how to fix it. I'm an organization freak and really really would love to have this planner work. Google sketch-up is way too much work, and I don't trust grid paper and cut outs of furniture to convey the depth I need to see. But maybe that's my only option at this point?
< Edited by Host >

HERE SHOULD BE YOUR SOLUTION:
Command+Space to bring up universal search, type in "Internet plug-ins"...
You may get multiple choices, one referencing OS-X Lion, perhaps one ref-ing your personal login...Choose one (I started with the main - OS X Lion - one)...it will open on your desktop...If you're like me (or like the Droitetgouche), you've already tried to install it, and it gave you all that crap about "can't be modified"...etc...So delete any of those plug-ins (there may be a few, depending how many installs you've tried), then right-click the "Internet Plug-ins" folder and choose "get info"...I'm not sure why "D...che" (spelling ease) couldn't change permissions...maybe wasn't logged in as the admin?...but click the "lock" symbol in the bottom right corner, unlock it, change ALL permissions to Read & Write, then relock it. Then open the IKEA dmg again and drag the item into the folder and it should work no problem.
Then quit Safari, restart, and it should let you work.
IF it doesn't, try going back to your universal search and choosing a different "Internet Plug-ins" folder...(Also, if you've tried the install, and you don't find any IKEA dmg's in the "Internet Plug-Ins" folder, you're likely in the wrong folder).
Also, you may want to go back later and restrict the read/write permissions when you're done with IKEA.
It worked for me, let me know if it works for you.

Why Can't VZ do the Right Thing For Once and Permit Network Extender Owners to Close their Networks?

Given the fact that the Network Extender can be set for managed access or open access, clearly it can technologically be configured so that a closed network could be set up so that ONLY those users that are included in the "priority list" could access the Network Extender.
If I had to guess, Verizon, prefers to benefit from your internet connection and your investment in a network extender by bolstering their network in poor reception areas for all of their customers in the vicinity on us Network Extender owners' backs rather than to do the right thing and permit a customer who has paid for the device as well as their internet access to close the network.
I find this sleazy and hope VZW will rethink its approach to this. We who subscribe to VZW for our cellular service pay the highest rates, on average, in the country for cell service. We have also paid hundreds of dollars for the Network Extender, and pay for the internet that is used to facilitate the phone calls made through the network extender.
Once it a while it would be nice if VZW did the right thing for its customers and not blatantly, at least, put their corporate greed about the needs of their customers.

I called Verizon tech support, and was informed that there is an option to close the Network Extender. This would allow only numbers on the white list to connect to the extender. Is the information I received incorrect? I spoke to them just the other day. Have you tried to configure the extender recently?
My post asking for clarification is here: https://community.verizonwireless.com/message/1002928#1002928
Thanks for any information you can provide.

WCCP Deny and permit ACL on 3750

Similar Messages

Maybe you are looking for