Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

VACL help

The issue I face is that I am trying to create an ACL that blocks outbound netbios traffic to the WAN. The challenge is that I don't have control over the router that connects to the WAN, however I do have control of the Layer 3 switch that connects to that router. I was wondering if there was a way (e.g via a VACL) where I could block this netbios traffic going out. The biggest issue is that the outbound interface to the router is a switchport (NOT ROUTED). I really dont want to change the configuration (i.e.making it a routed), so I was wondering if it is possible to do with the current configuration. I attached a diagram to show the network setup.

Any advice would be appreciated.


Re: VACL help

Hi Keyon,

You have to use NBAR to specifically drop the netbios traffic.

Iam not sure whether NBAR worls with VACLs though

Alternativley you can configure an access-list for each vlans and deny the ports used for netbios


Access-list 101 deny tcp any any eq 137

Access-list 101 deny tcp any any eq 138

Access-list 101 deny tcp any any eq 139

Access-list 101 permit ip any any

interface vlan 2

ip access-group 101 in



New Member

Re: VACL help

Narayan, thanks so much for your quick response. I had intitally thought about your second approach in putting an ACL on each vlan, however, I think that this would block netbios traffic between VLANs, which is what I am trying to avoid. The goal is to only have it blocked outbound towards the WAN. I will have to research the NBAR and see if that can help.

Thanks again!!

Re: VACL help

Hi Keyon,

You can permit the Inter VLAN subnets in the acces-list and still use the same approach.

Note:- NBAR does put some load on the device


CreatePlease to create content