I am having issues with a Cisco 1921 when it comes to access lists and vlans.

I have my vlan configured and interface with IP as well as the access group assigned to the vlan interface.

interface GigabitEthernet0/1.600
description Systems
encapsulation dot1Q 600
ip address
ip access-group VLAN600 out
ip helper-address
ip nat inside
ip virtual-reassembly in

ip access-list extended VLAN600
deny   ip
permit ip any

I can't access the 192.168.160.x network from the 10.10.6.x network, which is good, but I can see the gateway IP and ping it etc from the 192.168.160.x.subnet. How do I ensure that is blocked as well and not seen?

Also, how would I go about allowing certain machines on the vlan 1 (192.168.160.x subnet) access to a certain machine on the vlan600 (10.10.6.x subnet) by mac address?

I have tried "access-list 700 permit 0000.0000.0000 FFFF.FFFF.FFFF" without success, obviously with the correct MAC addresses.

If anyone has some insight, that would be great. Thanks.

1 Answer 1


You problem is that you are confusing in and out. The direction is from the router's perspective, so your access list, outbound from the router to VLAN 600 is denying anything from VLAN 600 out to VLAN 600 in an address range not on VLAN 600.

You should normally place extended access lists inbound and as close to the source as possible. If you want to prevent addresses on VLAN 600 from contacting addresses in another range, you should place the access list inbound on the VLAN 600 interface.

One problem you are going to face with allowing addresses in a different range to access addresses on VLAN 600 is that most things are bi-directional, so something from the other addresses could send something to VLAN 600, but it could never get a reply.

  • that's ok, i want a few machines in vlan1 to have bi-directional communications with 1 machine in vlan600. Just unsure how I would achieve this via MAC address. As for the out/in part, that makes sense. I will make necessary changes for that.
    – John
    Oct 5, 2016 at 3:11
  • If you deny every IP address in VLAN 600 from sending traffic to the other address range, you will not be able to reply from VLAN 600. You may be able to do something using reflexive access lists, but I don't think you will be successful mixing IP and MAC address access lists.
    – Ron Maupin
    Oct 5, 2016 at 3:14
  • Ok so i guess I should do it by IP then. Thanks.
    – John
    Oct 5, 2016 at 15:33
  • It actually makes more sense. Hardware breaks or gets updated, and you will end up with different MAC addresses, and changing ACLs is not something to be taken lightly. On the other hand, you can use DHCP reservations by MAC address, and that is fairly easy to change if the hardware breaks and gets replaced or updated.
    – Ron Maupin
    Oct 5, 2016 at 15:37
  • That was my plan :) now when i change the interface vlans to access group IN, will that prevent the 192.168.160.x subnet from being able to communicate with the vlan600 interface IP?
    – John
    Oct 5, 2016 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.