Hi i have Cisco switch model 2960 48 ports i plane to disable three ports on it for Internet service. I want to know how can apply the command on port number 20,21and 23 to close port number 80&443 .

  • You mean TCP ports 80 and 443 to the switch itself? The three ports are to be used as WAN ports? You'll need to set up a VLAN for these ports; you can't mix internal and external traffic.
    – Zac67
    Sep 16, 2017 at 16:26
  • Yes ,And used for WAN . Sep 16, 2017 at 16:54
  • Ok I will set up a new valn for it there is a command to close these ports on the port itself??? Sep 16, 2017 at 16:54
  • The management interfaces are bound to the IP address inside the default or the management VLAN. They can't be connected to from a VLAN with no IP address bound to.
    – Zac67
    Sep 16, 2017 at 17:06
  • 1
    @Network_infrastructure you are looking to use an ACL to do what you want. However, ACLs cannot be simply applied to a physical port on a 2960. It must be applied to a layer 3 boundary. This is a logical interface on a 2960. Without seeing a full configuration, the correct interface to which the ACL must be applied is impossible to know with any certainty. Also, the commands required to configure an ACL can vary by IOS and platform. A running configuration would help clarify any questions and allow us to provide better answers.
    – TDurden
    Sep 16, 2017 at 18:49

3 Answers 3


As I understand, you want to block http/https traffic on switch ports 20,21 and 23 so that users cannot access any web pages (http/https), is it correct?

If yes, you can try to use Port ACLs. You would need an ACL and apply it to switch ports 20,21 and 23.

Let me assume the format of your switch port 20 is f0/20, the following configuration is an example of Port ACLs on switch port 20:

 ip access-list extended block-http-https
    deny   tcp any any eq www
    deny   tcp any any eq 443
    permit ip any any

 interface FastEthernet0/20
   switchport mode access
   ip access-group block-http-https in

I hope it is helpful and answers your question.


A quite usual security practice is to have different VLAN's for different purposes.

And to place the switch management on the same VLAN as users, internet services is a bad practice if there isn't any special reasons for it.


Modification of Layer3 and above services is typically done at the gateway/router as switches do not read into frames. So, you would apply an access control list, ACL, at the gateway.

You would isolate out 'no-web' ports into a distinct VLAN then restrict for that VLAN's subnet.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.