Cisco Support Community
Community Member

SG500 ACL / ACE config with many VLANs

Good day!

My hardware:

  • Four SG500 52 and SG500 52P switches are in one stack with many vlans configured.
  • WLC which routes the internet ports. Static route on the sg500 stack.
  • DHCP Server
  • APs on trunk ports

Now I would like to put up some intervlan routing rules.


I would put the following ACEs into one ACL:


Copy machine 100: - permit -

DHCP server 101: - permit -

for 1 to vlan count: 192.168.vlanid.0 - permit 192.168.vlanid.0 -

Internet access: - permit any


Kindly point me to the right direction.

Essentially each VLAN should access a centralized copy machine/ vlan internal traffic shall be allowed / vlan internet traffic shall be allowed.

VLAN X to VLAN Y traffic should be blocked.


Thanks a lot. A link to manuals / tutorials are highly appreciated.


Cisco Employee

Hi,I follow the rule "the


I follow the rule "the simpler the better" and would create only 2 ACL one to block the traffic on VLAN X when DST subnet is VLAN Y and the second rule - the opposite direction.

You could even work with one of those ACL since most of the protocols would require return traffic anyway.

But with 2 ACL you limit unwanted traffic closer to source and also it is much more clear and understandable if you look at this settings a year later.



CreatePlease to create content