Solved: Blocking traffic between vlans

jgorman1977 · ‎12-11-2007

I have a guest wireless vlan (50) that connects to a cisco 3750. I want it to only allow its traffic to vlan (90) which is our firewall. I want to block it from the rest of the vlans.

Can anyone assist?

Jon Marshall · ‎12-11-2007

Hi

How many internal vlans other than vlan 50 do you have. I'm assuming that vlan 50 is allowed out through the firewall to any other IP addresses.

Lets say you have 3 internal vlans

vlan 10 - 192.168.5.0/24

vlan 11 - 192.168.6.0/24

vlan 12 - 192.168.7.0/24

you could use the following access-list

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.5.0 0.0.0.255

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.6.0 0.0.0.255

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.7.0 0.0.0.255

access-list 101 permit ip 192.168.254.0 0.0.0.255 any

int vlan 50

ip access-group 101 in

This would stop vlan 50 communicating with any of the other vlans, although your other vlans could still send packets into vlan 50, but would still allow it out via the firewall.

It all depends on how many internal vlans you have.

Jon

View solution in original post

Edison Ortiz · ‎12-11-2007

You can accomplish this with a VACL

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/12240se/scg1/swacl.htm

jgorman1977 · ‎12-11-2007

I'm confused on the syntax. I created a vacl to match 192.168.254.0 (guest vlan) to any and forward to vlan 90 (firewall vlan) only. I then lost internet connectivity on the internal network.

Jon Marshall · ‎12-11-2007

Hi