Hi Sean,
Attached is config (useless entries removed).
Traffice from VLAN2 should ONLY flow to VLAN 1 for webtraffic on ports 80 and 443.
I have a DNS server at 192.168.0.102, which has entries on the 192.168.0.x subnet, which works fine on that subnet for all computer attached to VLAN1.
Jeff.
---------------------
Using 18897 out of 131072 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Router
!
boot-start-marker
boot system flash c870-adventerprisek9-mz.123-8.YI3.bin
boot-end-marker
!
logging buffered 51200 debugging
enable secret 5 $1$OC/j$uR69snOYl8cqu4Y5CUUCr0
!
username accadmin privilege 15 secret 5 $1$hMT3$yonH5bVbG0jrycc/PkxKQ0
clock timezone MDT -7
clock summer-time MDT date Apr 6 2003 2:00 Oct 26 2003 2:00
no aaa new-model
ip subnet-zero
no ip source-route
ip cef
!
!
ip dhcp excluded-address 192.168.0.176 192.168.0.254
ip dhcp excluded-address 192.168.0.1 192.168.0.149
ip dhcp excluded-address 192.168.3.201 192.168.3.254
ip dhcp excluded-address 192.168.3.1 192.168.3.124
!
ip dhcp pool sdm-pool1
import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
domain-name
dns-server 192.168.0.102
lease infinite
!
ip dhcp pool sdm-pool2
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
dns-server 192.168.0.102
lease 0 3
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 192.168.3.1 255.255.255.0
ip access-group 103 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 remark INSIDE_IF=Vlan3
access-list 2 remark SDM_ACL Category=2
access-list 2 permit 192.168.3.0 0.0.0.255
access-list 101 remark SDM_ACL Category=1
access-list 101 remark Vlan1-Vlan2
access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.3.0 0.0.0.255 log
access-list 101 remark Vlan1-Any
access-list 101 permit ip 192.168.0.0 0.0.0.255 any log
access-list 103 remark SDM_ACL Category=1
access-list 103 permit udp any any eq bootpc
access-list 103 permit udp any any eq bootps
access-list 103 permit tcp any any eq domain
access-list 103 permit udp any any eq domain
access-list 103 remark Vlan2-Vlan1
access-list 103 deny ip 192.168.3.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 103 permit ip 192.168.3.0 0.0.0.255 any
