0

I have a topology like this

PC1 ------Switch
PC2 ------Layer --------- Router
PC3-------two

PC1 192.168.1.34 VLAN 10.

PC2 192.168.1.50 VLAN 20. 
PC3 192.168.1.51 VLAN 20.

I configured a router on a stick to ping between any PC. Then, I want PC2 can ping PC1 and PC3 cannot ping PC1. I use an access list to the switch:

conf t
access-list 101 permit ip host 192.168.1.50 host 192.168.1.34
access-list 101 deny ip host 192.168.1.51 host 192.168.1.34
int f1/0
ip access-group 101 in
end

but it doesn't work. Can you tell me why? I've tried configuring to the router, but it's doesn't work, either.

I configured in GNS3 which doesn't support access-map.

  • 2
    Can we see the router configuration? – Mike Pennington Nov 5 '13 at 2:08
  • Which switch ports are involved in this setup and what is their configuration? – Daniel Yuste Aroca Nov 5 '13 at 21:25
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 21:24
2

First you must deny the packets from host 3 to host 1; then permit any thing else.

access-list 101 deny ip host 192.168.1.51 host 192.168.1.34
access-list 101 permit ip any any

however, if you want only to deny the ping, you must use icmp instead of ip in the deny part:

access-list 101 deny icmp host 192.168.1.51 host 192.168.1.34 echo
1

Apply this ACL to the VLAN instead of the interface.

  • It would be the sub-interface in this case since the switch is only layer two. – Fallacy11 Mar 11 '16 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.