Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Access restriction via vlan

Hi All,

Can someone tell me the easiest way to restrict a vlan to only be able to access the internet. Basically I would like to an area for vendors to plug in and be able to access the internet, but not my internal network.

TIA,

R

1 ACCEPTED SOLUTION

Accepted Solutions
Purple

Re: Access restriction via vlan

Hi,

That will not quite work. The destination address of the traffic will not be the default gateway address - the traffic is sent to the default gateway but the actual destination IP address is that of wherever it is going.

One way of restricting this traffic is to deny all traffic from this network to your internal network and then open up a few ports to the Internet:

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq www

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq telnet

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq smtp

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any pop3

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq 21

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq 20

However, FTP will not work too well with the above because of the way FTP uses dynamic ports. An alternative is to block all traffic from this subnet to your internal networks and permit everything else:

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 permit ip 192.168.70.0 0.0.0.255 any

Hope that helps - pls rate the post if it does.

Paresh

4 REPLIES

Re: Access restriction via vlan

New Member

Re: Access restriction via vlan

Thanks for your reply. I figured this was the case, but wanted to make sure.

i am new to ACL, can I do this?

access-list 102 permit tcp 192.168.70.0 0.0.0.255 host 192.168.40.254 eq www

access-list 102 permit tcp 192.168.70.0 0.0.0.255 host 192.168.40.254 eq telnet

access-list 102 permit tcp 192.168.70.0 0.0.0.255 host 192.168.40.254 eq smtp

access-list 102 permit tcp 192.168.70.0 0.0.0.255 host 192.168.40.254 pop3

access-list 102 permit tcp 192.168.70.0 0.0.0.255 host 192.168.40.254 eq 21

access-list 102 permit tcp 192.168.70.0 0.0.0.255 host 192.168.40.254 eq 20

To allow all hosts on the 192.168.70.0/24 network access to HTTP, Telnet, Mail, POP3, and FTP destined for the host ip of 192.168.40.254 (with this being the default gateway ip)

Is there also an implicit deny all at the end without a need for me to put this?

TIA,

R

Purple

Re: Access restriction via vlan

Hi,

That will not quite work. The destination address of the traffic will not be the default gateway address - the traffic is sent to the default gateway but the actual destination IP address is that of wherever it is going.

One way of restricting this traffic is to deny all traffic from this network to your internal network and then open up a few ports to the Internet:

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq www

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq telnet

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq smtp

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any pop3

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq 21

access-list 102 permit tcp 192.168.70.0 0.0.0.255 any eq 20

However, FTP will not work too well with the above because of the way FTP uses dynamic ports. An alternative is to block all traffic from this subnet to your internal networks and permit everything else:

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 deny ip 192.168.70.0 0.0.0.255

access-list 102 permit ip 192.168.70.0 0.0.0.255 any

Hope that helps - pls rate the post if it does.

Paresh

New Member

Re: Access restriction via vlan

ah! many thanks to you! again!

162
Views
4
Helpful
4
Replies
CreatePlease to create content