1

I am having issues with a Cisco 1921 when it comes to access lists and vlans.

I have my vlan configured and interface with IP as well as the access group assigned to the vlan interface.

interface GigabitEthernet0/1.600
description Systems
encapsulation dot1Q 600
ip address 10.10.6.1 255.255.255.0
ip access-group VLAN600 out
ip helper-address 192.168.160.3
ip nat inside
ip virtual-reassembly in
!

ip access-list extended VLAN600
deny   ip 10.10.6.0 0.0.0.255 192.168.160.0 0.0.0.255
permit ip 10.10.6.0 0.0.0.255 any

I can't access the 192.168.160.x network from the 10.10.6.x network, which is good, but I can see the 10.10.6.1 gateway IP and ping it etc from the 192.168.160.x.subnet. How do I ensure that is blocked as well and not seen?

Also, how would I go about allowing certain machines on the vlan 1 (192.168.160.x subnet) access to a certain machine on the vlan600 (10.10.6.x subnet) by mac address?

I have tried "access-list 700 permit 0000.0000.0000 FFFF.FFFF.FFFF" without success, obviously with the correct MAC addresses.

If anyone has some insight, that would be great. Thanks.

0

You problem is that you are confusing in and out. The direction is from the router's perspective, so your access list, outbound from the router to VLAN 600 is denying anything from VLAN 600 out to VLAN 600 in an address range not on VLAN 600.

You should normally place extended access lists inbound and as close to the source as possible. If you want to prevent addresses on VLAN 600 from contacting addresses in another range, you should place the access list inbound on the VLAN 600 interface.

One problem you are going to face with allowing addresses in a different range to access addresses on VLAN 600 is that most things are bi-directional, so something from the other addresses could send something to VLAN 600, but it could never get a reply.

8
  • that's ok, i want a few machines in vlan1 to have bi-directional communications with 1 machine in vlan600. Just unsure how I would achieve this via MAC address. As for the out/in part, that makes sense. I will make necessary changes for that. – John Oct 5 '16 at 3:11
  • If you deny every IP address in VLAN 600 from sending traffic to the other address range, you will not be able to reply from VLAN 600. You may be able to do something using reflexive access lists, but I don't think you will be successful mixing IP and MAC address access lists. – Ron Maupin Oct 5 '16 at 3:14
  • Ok so i guess I should do it by IP then. Thanks. – John Oct 5 '16 at 15:33
  • It actually makes more sense. Hardware breaks or gets updated, and you will end up with different MAC addresses, and changing ACLs is not something to be taken lightly. On the other hand, you can use DHCP reservations by MAC address, and that is fairly easy to change if the hardware breaks and gets replaced or updated. – Ron Maupin Oct 5 '16 at 15:37
  • That was my plan :) now when i change the interface vlans to access group IN, will that prevent the 192.168.160.x subnet from being able to communicate with the vlan600 interface IP? – John Oct 5 '16 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.