I'm still new to networking and have a question or problem I need to solve, but I'm not sure how to move forward. I need to stop PC0 from Vlan10 from talking to PC5 in Vlan30, but he must be able to still talk to PC4 which is also in Vlan30. How many ACLs do I need?

Also, what commands do I add to them. I know standard ACLs, and I worked with extended, but like I said, I'm still new and not sure how to block one PC and not the other.

enter image description here

  • books.google.com/… Nov 21, 2016 at 2:30
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15, 2017 at 1:13

2 Answers 2


You can do this with a single extended ACL because it has both a source and destination address. You can use the host keyword on both addresses since you only want to block one host from reaching another host.

Something like:

ip access-list extended TEST
 deny ip host <PC0 address> host <PC5 address>
 permit ip any any

In general, standard ACLs should be placed as close to the destination as possible, in order to not block too much, and extended ACLs should be placed as close to the source as possible, in order to keep the router from needlessly routing traffic which will be dropped.


Configure Commonly Used IP ACLs by Cisco shows:

hostname R1
interface ethernet0
ip access-group 1 in
access-list 1 deny host
access-list 1 permit any

Port ACLs (PACLs) offer the ability to filter/deny a specific MAC address on the Ethernet switch port. Check your switch for feature availability.

Switch(config)# mac access-list extended simple-mac-acl
Switch(config-ext-macl)# deny host 000.000.011 any
Switch(config-ext-macl)# end

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.