Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Blocking traffic between vlans

I have a guest wireless vlan (50) that connects to a cisco 3750. I want it to only allow its traffic to vlan (90) which is our firewall. I want to block it from the rest of the vlans.

Can anyone assist?

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: Blocking traffic between vlans

Hi

How many internal vlans other than vlan 50 do you have. I'm assuming that vlan 50 is allowed out through the firewall to any other IP addresses.

Lets say you have 3 internal vlans

vlan 10 - 192.168.5.0/24

vlan 11 - 192.168.6.0/24

vlan 12 - 192.168.7.0/24

you could use the following access-list

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.5.0 0.0.0.255

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.6.0 0.0.0.255

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.7.0 0.0.0.255

access-list 101 permit ip 192.168.254.0 0.0.0.255 any

int vlan 50

ip access-group 101 in

This would stop vlan 50 communicating with any of the other vlans, although your other vlans could still send packets into vlan 50, but would still allow it out via the firewall.

It all depends on how many internal vlans you have.

Jon

4 REPLIES
Hall of Fame Super Bronze

Re: Blocking traffic between vlans

New Member

Re: Blocking traffic between vlans

I'm confused on the syntax. I created a vacl to match 192.168.254.0 (guest vlan) to any and forward to vlan 90 (firewall vlan) only. I then lost internet connectivity on the internal network.

Hall of Fame Super Blue

Re: Blocking traffic between vlans

Hi

How many internal vlans other than vlan 50 do you have. I'm assuming that vlan 50 is allowed out through the firewall to any other IP addresses.

Lets say you have 3 internal vlans

vlan 10 - 192.168.5.0/24

vlan 11 - 192.168.6.0/24

vlan 12 - 192.168.7.0/24

you could use the following access-list

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.5.0 0.0.0.255

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.6.0 0.0.0.255

access-list 101 deny ip 192.168.254.0 0.0.0.255 192.168.7.0 0.0.0.255

access-list 101 permit ip 192.168.254.0 0.0.0.255 any

int vlan 50

ip access-group 101 in

This would stop vlan 50 communicating with any of the other vlans, although your other vlans could still send packets into vlan 50, but would still allow it out via the firewall.

It all depends on how many internal vlans you have.

Jon

New Member

Re: Blocking traffic between vlans

I implemented the ACL's, but am still able to browse the internal network. Any suggestions on what I may have missed?

145
Views
0
Helpful
4
Replies