- Posts: 5
- Thank you received: 0
VLAN traffic blocking from and to other VLANS Cisco
14 years 9 months ago #33580
by dxmen
Replied by dxmen on topic Re: VLAN traffic blocking from and to other VLANS Cisco
Thanks Ammar, one more question and taking your example, if I need to block another VLAN for example VLAN3 (192.168.3.0) can I just add the subnet to the same ACL and then apply it to the VLAN3 interface or does it need to be another ACL's for example access-list 200?
code:
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip any any
applied
interface vlan1
ip access-group 100 in
interface vlan3
ip access-group 100 in
or
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip any any
access-list 200 deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 200 permit ip any any
applied
interface vlan1
ip access-group 100 in
interface vlan3
ip access-group 200 in
thanks so much in advance to everybody!
code:
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip any any
applied
interface vlan1
ip access-group 100 in
interface vlan3
ip access-group 100 in
or
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip any any
access-list 200 deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 200 permit ip any any
applied
interface vlan1
ip access-group 100 in
interface vlan3
ip access-group 200 in
thanks so much in advance to everybody!
14 years 9 months ago #33581
by S0lo
Studying CCNP...
Ammar Muqaddas
Forum Moderator
www.firewall.cx
Replied by S0lo on topic Re: VLAN traffic blocking from and to other VLANS Cisco
You're welcome dxmen
Both ways will work. But the second (i.e two separate ACLs) is more efficient. Because, having only one ACL with two deny statements will force the router to check both statements every time a packet passes through, one of the statements is always redundant, so that's a waste of CPU time.
Both ways will work. But the second (i.e two separate ACLs) is more efficient. Because, having only one ACL with two deny statements will force the router to check both statements every time a packet passes through, one of the statements is always redundant, so that's a waste of CPU time.
Studying CCNP...
Ammar Muqaddas
Forum Moderator
www.firewall.cx
14 years 9 months ago #33585
by dxmen
Replied by dxmen on topic Re: VLAN traffic blocking from and to other VLANS Cisco
Great! thanks so much to all for all your help, now I have everything I need to complete what I need. Cheers!!
Regards
Regards
- ToxicAvenger
- Offline
- New Member
Less
More
- Posts: 13
- Thank you received: 0
14 years 4 months ago #35011
by ToxicAvenger
enjoy
www.ciscosysteme.com/en/US/products/hw/s...186a008013565f.shtml
Replied by ToxicAvenger on topic Re: VLAN traffic blocking from and to other VLANS Cisco
I have 4 VLANs on a Cisco 4500 L3 switch
VLAN 2
VLAN 3
VLAN 4
VLAN 5
I want to block in / out traffic from VLAN 4 & 5 to VLAN 3, any suggestions? thanks
enjoy
www.ciscosysteme.com/en/US/products/hw/s...186a008013565f.shtml
Time to create page: 0.144 seconds