ok

How about if I have another host 10.2.2.3 on the remote site ?

will the traffic be blocked from 10.1.1.1 to 10.2.2.3 as well ?

ok I clarify

10.1.1.1 is in vlan 599

source is 10.1.1.1

destinations are 10.2.2.2 and 10.2.2.3

my acl is

access-list 180 permit host 10.1.1.1 host 10.2.2.2

Int VLAN 599

ip access-g 180 in

So ,

1) do I need :

access-list 180 permit host 10.2.2.2 host 10.1.1.1 to allow the return traffic ?

2) Do I need to do something on my acl to deny traffic from 10.2.2.2 to 10.1.1.1 ?

1) No you don't because ACL 180 is only applied inbound on interface vlan 599. So when the return traffic comes back from 10.2.2.2 it will be be outbound traffic on vlan 599 and as you don't have an acl in the outbound direction you will be fine.

2) Do you mean 10.2.2.3 and not 10.2.2.2 because i thought you wanted to allow traffic to and from 10.2.2.2 ?

Assuming 10.2.2.3

if all your access-list 180 says is

access-list 180 permit ip host 10.1.1.1 host 10.2.2.2

then you have an implicit deny at the end of the acl so in effect all traffic from vlan 599 will be blocked except traffic from 10.1.1.1 to 10.2.2.2.

If this is not what you want

access-list 180 deny host 10.1.1.1 host 10.2.2.3

access-list 180 permit ip any any

ie. only stop traffic from vlan 599 to 10.2.2.3.

If you want to actually stop 10.2.2.3 from intiating a connection to 10.1.1.1 then

access-list 181 deny ip host 10.2.2.3 host 10.1.1.1

access-list 181 permit ip any any

then apply to interface that 10.2.2.3 lives on eg.

vlan 600

ip access-group 181 in

HTH

Jon

Hi

Ok thanks

last one :

is it possible to put to different access-group on an interface

inter fa 0/0

ip access-group 180 out

ip access-group 190 in

?

Yes, you can have one inbound and one outbound access-list on an interface.

Jon