Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

blocking traffic on one vlan from other vlans

Hi Good morning everyone! Thank you for your help in advance. Hope you can help~~

Now I would like to setup a new vlan on our network/core switch (we have some other vlans running). But in the new vlan, we do not want to allow other users from other vlans to access to it. May you  mind if you would help to guide me thru the configuration on the core switch?

By the way, other vlans can communicate with between and I need to keep the same state for the rest of the vlan

Thank you very much for your help.

Takami Chiro

New Member

Re:blocking traffic on one vlan from other vlans

Does the machines in the vlan need any access outside the vlan at all?

If not then just have flat layer 2 vlan with no default gateway.

If they do then have an outbound access list on that vlan interface to prevent all the networks you wish to block.

Sent from Cisco Technical Support Android App

New Member

Re:blocking traffic on one vlan from other vlans

Hi Bobson

I understand that you want to create a new vlan but id does't have to have connection with the rest of the all vlans, in this case you could configure a Vlan Access List, tahat could be the better option, tell me to show you some examples

New Member

Re:blocking traffic on one vlan from other vlans

Hi Simon and Oscar, thank you for the response. Oscar...may you mind if you would show me the config example? The new vlan will have to access internet but do not want other vlans to access to the new vlan...

I do not want to mess up the production network so the demo would be great

Thank yoU!

Takami Chiro

New Member

Re:blocking traffic on one vlan from other vlans

Hi, perfect.

The example would be the next:

To have access to internet and drop the all traffic only we have to define the addresses to be droped (the vlans

Define a VLAN Access Map

Switch(config)# vlan access-map  (name vacl) (no. seq.)

Define the IP ACL (the ACL has to be configured prevously)

Switch(config-access-map)# match ip address (ACL)

Define the action

Switch(config-access-map)# action ( drop | forward )

Apply the vlan map to a specific vlan

Switch(config)# vlan filter (name vacl) vlan-list (vlan’s)



Vlan access-map CiscoVACL 10

      action drop

      match ip address 1

Vlan access-map CiscoVACL 20

      action forward

Vlan filter CiscoVACL vlan-list 1-4096

Vlan internal allocation policy ascending


Access-list 1 permit   <---- you should configure the all vlans in this ACL


I really hope to help you

New Member

Re:blocking traffic on one vlan from other vlans

Oscar forgive me here, but how does a layer 2 VACL deny traffic from other vlans entering this vlan?  A VACL is used to filter traffic within the same VLAN not between VLANS, a standard or extended ACL should be used on the layer 3 vlan interface outbound.

Please elaborate your example above?

CreatePlease to create content