Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Access-List Question

Hi There;

I am using the 'router-on-a-stick' method with 5 VLANS and associated sub-interfaces. I created this access-list - 'access-list 102 permit icmp 192.168.20 (vlan number).0 0.0.0.255 172.30.0.0 (serial interface) 0.0.255.255. This works as intended - I can ping the 172.30.X.X serial interfaces and I cannot ping the other vlan devices. However, I want to be able to ping my own sub-interface but none of the other VLAN sub-interfaces.

thanks

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Access-List Question

Hi Darren,

if you add this line to the access-list, it will allow you to ping the interface with address 192.168.20.1.

Don't forget that at the end of an access-list there is a "deny ip any any" command.

So if you want to allow USER TRAFFIC to other destinations, then you should explicitly allow that traffic as well.

Cheers:

Istvan

3 REPLIES

Re: Access-List Question

Hi Darren,

I hope I understand you config well. You should add a line to the access-list allowing the address of the subinterface:

access-list 102 permit icmp 192.168.20 (vlan number).0 0.0.0.255 172.30.0.0 (serial interface) 0.0.255.255.

access-list 102 permit icmp 192.168.20 (vlan number).0 0.0.0.255 x.x.x.x (subinterface) y.y.y.y

Cheers:

Istvan

New Member

Re: Access-List Question

Hi There;

The address I want to get to is 192.168.20.1. So would I write 'access-list 102 permit icmp 192.168.20.0 0.0.0.255 192.168.20.1 0.0.0.0'

thanks

Re: Access-List Question

Hi Darren,

if you add this line to the access-list, it will allow you to ping the interface with address 192.168.20.1.

Don't forget that at the end of an access-list there is a "deny ip any any" command.

So if you want to allow USER TRAFFIC to other destinations, then you should explicitly allow that traffic as well.

Cheers:

Istvan

140
Views
0
Helpful
3
Replies
CreatePlease to create content