prevent communication at layer 3

[Kn1ghtR1d3rOfD00m]

Hi, 

I wonder how can I prevent ping from each subnet so they cannot see each other, I know that it might be with an ACL, does any have any idea?

I have the following 2 interface vlans

Interface Vlan10
description  SUBNET 1
ip address 10.13.136.2 255.255.252.0
no shut
end

Interface Vlan20
description  SUBNET 1
ip address 10.13.136.2 255.255.252.0
no shut
end

But I can ping from any IP from one subnet to any other IP on the other subnet. How to stop and avoid icmp only for those specific networks from seeing each other?

Thanks

[cofee]

I would like to bring it to your attention that you are using same subnets for both vlans. The next valid network address for this subnet would be 10.13.140.0 255.255.252.0.

This is how you can block all traffic from one subnet to another:

access-list 101 deny ip 10.13.136.0 0.0.3.0 10.13.140.0 0.0.3.0

access-list 101 permit ip any any ( This is optional if you want to permit traffic to and from other networks)

Applying access-list to SVI:

int vlan 10

ip access-group 101 in

[cofee]

I have read your question again and it looks like you have intentionally created duplicate subnets on the same switch and now want to prevent them from seeing each other. Why would you do that or is this a college assignment?

You shouldn't be able to assign duplicate address to physical or logical interfaces of the same device or network address.

[Kn1ghtR1d3rOfD00m]

Hi, 

thanks, yes, it was a typo, no duplicate address should be. Its two completely subnets, just ignore the subnets, pretend that they are different. 

thanks for your reply

[Julio E. Moisa · Accepted solution]

Hi
As other members are mentioned, you can use an ACL:

If you are going to filter the traffic originated into a SVI your ACL should be IN direction, you can filter ICMP, echo/echo-reply

:-)

[paul driver]

Hello

you are correct a Routed ACL would be applicable between the two SVI's to deny ICMP only.

example:

Ip access-list extended No_Vl20

deny icmp 10.13.137.0 0.0.0.255 any
permit ip any any

int vlan 10
Ip access-group No_Vl20 out

Ip access-list extended No_Vl10

deny icmp 10.13.136.0 0.0.0.255 any
permit ip any any

int vlan 20
Ip access-group No_Vl10 out

res
Paul