Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

vlan routing


We are using vlan routing at our company to connect to different vlans from our management vlan. Now we want the management vlan to be able to talk to all the other vlans. but all other vlans not together. explained briefly: host a is allowed to host b but  host b should not be allowed to host a. now I have created an ACL so VLAN 102 cant talk to VLAN 20. but then the ACL blocked the entire traffic between two hosts which is not the intention. Does anyone has a solution for me? Here below my config. It's an layer 3 switch.


some help would be great!


ip routing


interface Vlan1
 no ip address
interface Vlan101
 ip address
interface Vlan102
 ip address
 ip access-group Drop_201 in
interface Vlan201
 ip address
interface Vlan205
 ip address
interface Vlan206
 ip address

ip access-list extended Drop_201
 permit icmp any any
 deny ip any
 permit ip any any


Everyone's tags (1)
New Member

Hi,I would suggest you to use


I would suggest you to use vlan acl as it will works better for vlan filtering method.

The sample config is as follows.

ip access-list standard Permit_Traffic
permit any

ip access-list standard Deny_Traffic

vlan access-map BLOCK_VLAN20 10
match ip address Deny_Traffic
action drop

vlan access-map BLOCK_VLAN20 20
match ip address Permit_Traffic
action forward

vlan filter BLOCK_VLAN20 vlan-list  20

after applying this,host from vlan 102 will not be able to communicate with vlan 20 but others.

I hope it will clear your issue.


New Member

Hi, Thanks for answering. I

Hi, Thanks for answering. I will give you a reply if i have tested it!

New Member

Hi Mitesh Manwatkar,I tried

Hi Mitesh Manwatkar,

I tried what you suggest but it doesn't work. It blocks the entire traffic between vlans and thats not right. it has to be that vlan10 can acces vlan 20 but vlan 20 cant acces vlan 10 for example. Do you have other options for me ?


Kind regards.

CreatePlease login to create content