I have a topology like this

PC1 ------Switch
PC2 ------Layer --------- Router

PC1 VLAN 10.

PC2 VLAN 20. 
PC3 VLAN 20.

I configured a router on a stick to ping between any PC. Then, I want PC2 can ping PC1 and PC3 cannot ping PC1. I use an access list to the switch:

conf t
access-list 101 permit ip host host
access-list 101 deny ip host host
int f1/0
ip access-group 101 in

but it doesn't work. Can you tell me why? I've tried configuring to the router, but it's doesn't work, either.

I configured in GNS3 which doesn't support access-map.

  • 2
    Can we see the router configuration? Nov 5, 2013 at 2:08
  • Which switch ports are involved in this setup and what is their configuration? Nov 5, 2013 at 21:25
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7, 2017 at 21:24

2 Answers 2


First you must deny the packets from host 3 to host 1; then permit any thing else.

access-list 101 deny ip host host
access-list 101 permit ip any any

however, if you want only to deny the ping, you must use icmp instead of ip in the deny part:

access-list 101 deny icmp host host echo

Apply this ACL to the VLAN instead of the interface.

  • It would be the sub-interface in this case since the switch is only layer two.
    – Fallacy11
    Mar 11, 2016 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.