Vlan ACL

[mansoor_nawaz78]

I am trying to configuring VACL, on a L3 & L2 swiches network, multiple VALN are running, how can i restrick a single user of any VLAN not to receive the broadcast of the other same VLAN, and second think, i implement this access list, if IP is 10.1.1.12

ip access-list extended NAME

permit ip host 10.1.1.12 10.1.1.0 0.0.0.255

and add this list into "VLAN access-map"

and use a "Vlan filter command" to implement this access list into a specific VLAN.

is it right ?

[pkhatri]

Yes, the procedure is correct.

From your ACL, it appears that there is only one device in that VLAN of yours. Is that correct ? The VACL will filter out traffic from any device other than that with ip 10.1.1.12. If that is what you want, then the VACL should work.

Hope that helps - pls rate the post if it does.

Paresh

[mansoor_nawaz78]

Thanks for Reply,

There is not only my device in the VLAN's, if there is 100 devices (client) will it work correct.

[pkhatri]

If that is the case, it will not work too well.

Would you be able to explain your complete security requirements, in order for me to understand what you are trying to achieve ?

Paresh

[mansoor_nawaz78]

If we define a multiple VLANs in our networks, in a single VLAN, traffic broadcast for all that VLAN clients, how can i restrict this broADCAST TRAFFIC

[pkhatri]

Hi,

Broadcast is useful for quite a lot of functions - things such as ARP, DHCP etc will break if you somehow filter out all broadcast traffic.

A better solution is to limited the amount of broadcast traffic per port using the 'storm-control broadcast level' command.

Hope that helps - pls rate the post if it does.

Paresh

[mansoor_nawaz78]

OK,

If i am using L3 switches for inter VLAN communication, will this storm control implement on L3 or L2 switches(through which client connected).

Thanks & Regard

[pkhatri]

You would do that on the L2 switch ports...

Hope that helps - pls rate the post if it does.

Paresh