I'm designing a network with the following scheme:

Network schema

I have 5 vlans, 3 on S1 and 2 on S3. I'm currently concerned with making access list. Each vlan has a web server that is configured to listen on both port 8080 and 80.

I want to use access lists on the router R3(for example) to permit http requests to the host( on port 80, but to deny them on port 8080.

I have entered the following commands on router R3:

Access lists

But this denies access on both ports, that is I can't open the web page from network, address

On router R3 I have configured subinterfaces g0/1.10, 20, 30(for VLANs 10, 20, 30 respectively) with the following commands:

ip access-group 100 in
ip access-group 100 out

What should I do?

  • Where is network on the diagram? In which VLAN? Can you also provide IP addressing scheme to diagram?
    – phandox
    Commented Apr 23, 2016 at 9:22
  • Vlans are ordered from left to right - 10 to 50. Adresses 192.168.x.0 from left to right where x i between 0 and 4 inclusive. Vlan 10 i etc. Commented Apr 23, 2016 at 9:25

2 Answers 2


You should craft an ACL for one direction. Don't put the same ACL on every interface in both directions.

The general ACL rules:

  1. An extended ACL has both the source and destination addresses. It should be placed inbound on the source interface where the source address is. This prevents the denied traffic from being routed at all.
  2. A standard ACL doesn't have the destination address, only the source address. It should be placed outbound on the interface where the destination address is. This means the traffic will be routed, but it prevents the ACL from affecting too much traffic.

Your extended ACL 100 should only be on the router's interface for the VLAN with (per your comment, VLAN 20) as an inbound ACL:

interface Vlan20
 ip access-group 100 in

This will immediately drop any TCP traffic coming into the router from destined to, preventing the router from having to route that traffic. It will allow ICMP echos and other TCP traffic to, but it will deny all other traffic (ACLs have an implicit deny any any as the last statement. You should probably change the ACL so that it will permit all other traffic, unless you really only want to allow hosts on that VLAN to ping and use all other TCP only with The hosts on that VLAN will not be able to get to any other VLAN, except with ping.


Your specified access-list looks good. The mistake is in applying it on the interface. Say you want to restrict access to web server on IP You are using extended ACLs so therefore they should be places as close to destination as possible to save some processing time. You want to apply it on interface g0/0.10, but only in out direction. Why is that? Out means that everything that comes OUT of g0/0.10 interface, that is everything that is routed TO VLAN 10 from any source.

So to wrap this up, you should do this on interface g0/0.10

ip access-group 100 out

and you should be good to go. Other interfaces should be unaffected, you apply this access list ONLY on the interface g0/0.10

  • "You are using extended ACLs so therefore they should be places as close to destination as possible to save some processing time." Actually, that would be exactly backwards. Since standard ACLs don't include a destination, you place them as close to the destination as possible, so that you don't restrict too much, while extended ACLs do include the destination, so you place them as close to the source as possible to save processing time.
    – Ron Maupin
    Commented Apr 23, 2016 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.