Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco 887 no ip access-group

Hi,

I am not able to apply an access-list to FastEthernet 0 as the ip access-group is not supported in Interface mode but only in interface vlan mode.

How can I stop traffic into the LAN network?

Cheers,

Pei Wai.

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Cisco 887 no ip access-group

Hello Leepewai,

an ACL is an OSI layer3 object so it can only be applied to a L3 interface that is the Vlan interface in your case as the fastethernet port is a switchport ( like a L2 LAN switch port) in your router.

You should be able to achieve the desired traffic filtering by applying the ACL on the SVI interface using ip access-group at interface vlan level.

Your only limitation is that you cannot filter traffic between fastethernet ports ( traffic within the IP subnet associated to the Vlan) that are member of the same L2 Vlan. This can be achieved on a multilayer switch like C3750 using VACL feature.

Hope to help

Giuseppe

6 REPLIES
Hall of Fame Super Silver

Cisco 887 no ip access-group

Hello Leepewai,

an ACL is an OSI layer3 object so it can only be applied to a L3 interface that is the Vlan interface in your case as the fastethernet port is a switchport ( like a L2 LAN switch port) in your router.

You should be able to achieve the desired traffic filtering by applying the ACL on the SVI interface using ip access-group at interface vlan level.

Your only limitation is that you cannot filter traffic between fastethernet ports ( traffic within the IP subnet associated to the Vlan) that are member of the same L2 Vlan. This can be achieved on a multilayer switch like C3750 using VACL feature.

Hope to help

Giuseppe

New Member

Cisco 887 no ip access-group

Hello Giuseppe,

So I understood why ACL cannot be applied to fastethernet as it is switchport, thanks!

I have 2 subnet: VLAN 2 (office)-192.168.89.0/24 , VLAN 3 (wireless guest)-10.127.0.0/24.

Both VLAN can accesss to Internet, but VLAN 3 should not access to VLAN 2

I created an ACL:

Access-list 33 permit 192.168.89.0 0.0.0.255

Then I applied it to Interface VLAN 2:

INTERFACE VLAN 2

IP Access-Group 33 IN

However, I am still able to ping to the VLAN 2 (192.168.89.1) from the Guest PC.

Please advise how do I stop Guest PC to acccess to VLAN 2?

Cheers,

Pei Wai

Hall of Fame Super Silver

Cisco 887 no ip access-group

Hello Pei Wai,

I would suggest to use an extended IP ACL as you want to block communication between Vlan2 and Vlan3

access-list 101 remark deny vlan3 to vlan2

access-list 101 deny ip 192.168.89.0 0.0.0.255 10.127.0.0 0.0.0.255

access-list 101 permit ip any any

int vlan2

ip access-group 101 in

This should break communication between vlan2 and vlan3 without impacting internet connectivity

Your ACL 33 allows traffic sourced from 192.168.89.0/24 including that with destination 10127.0.0/24

Hope to help

Giuseppe

New Member

Cisco 887 no ip access-group

Hi Giuseppe,

I tried the ACL 101 above and applied to VLAN 2 but traffic from wireless Guest network still can ping to 192.168.89.1 (VLAN 2 interface).

I even tried removing permit ip any any, traffic from Guest still can ping to 192.168.89.1.

note: access-point has its own module: service-module wlan-ap 0 session.

I tried to apply an ACL on the INT Gi0 and deny everyhing, but still not able to stop Guest to access to VLAN 2.

Please advise.

Pei Wai.

New Member

Cisco 887 no ip access-group

And also, 887 does not support vlan access-map.

New Member

Cisco 887 no ip access-group

Got it sorted.

I apply the ACL on int VLAN3:

access-list 113 deny   ip 10.127.0.0 0.0.0.255 192.168.89.0 0.0.0.255

access-list 113 permit ip any any

INT VLAN3

ip access-group 113 in

Guest Traffic (10.127.0.0) to 192.168.89.0 is stopped at the entrance to VLAN3.

Cheers,

Pei Wai

1934
Views
0
Helpful
6
Replies