Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

VLAN - Intenet Access Only

I have a cisco 3750 switch. It currently has 2 vlans on it. I would like to be able to provide internet only access from this switch to a meeting room. What is the easiest and most ssecure way to do this? Thank you.

New Member

Re: VLAN - Intenet Access Only

You would create an additional VLAN and then apply an access list on the VLAN interface that precludes traffic except to the internet. Let's assume you have created VLAN 20 and want to use that as your Internet only VLAN. The example below allows for the client to obtain a dhcp address and to use dns services internally. You then block access to all RFC 1918 (private) addresses, assuming that's what you are using internally. The helper-address is for DHCP.

interface Vlan20

ip address

ip access-group guest in

ip helper-address

ip access-list extended guest

permit udp any any eq bootps

permit udp any any eq bootpc

permit udp host eq domain

permit udp host eq domain

deny ip

deny ip

deny ip

permit tcp any

deny ip any any log

New Member

Re: VLAN - Intenet Access Only

I was assuming you were doing layer 3 on the switches; if not you would apply the access-list to the interface/sub-interface on the router.


Re: VLAN - Intenet Access Only

Another simple approach would be to create an Internet-Only 3rd VLAN. Keep this VLAN Layer2, no Layer3 switching. Connect this VLAN to a DMZ port on your firewall. Configure the firewall such that the DMZ is only allowed internet access, no access from or to the Internal network.

You will need to provide a DHCP server for this VLAN.

Please rate all helpful posts.



CreatePlease to create content