1

So I have two subnets:

Subnet 1:200.190.64.0/28 which is connected to router 2

Subnet 2:20.10.96.0/21 which is connected to router 1

Both of these routers have another networked connected to them as well.

Now my question is how do I deny subnet 200.190.64.0 access to subnet 20.10.96.0 while allowing other networks to communicate.

So I have done Access-list stranded but the problem is that my other networks also can't access it as well; everything gets blocked.

Code that I am running

access-list deny host 200.190.64.0 0.0.0.15

access-list permit any

I tried this command on all of the router's interfaces

enter image description here

enter image description here

ROUTER 1 CONFIG

Improve this question
4
  • You need to explain on which router you are placing the ACL, and on which interface you are applying the ACL. You really need to give us the full router configurations, at least for the router where you are placing the ACL.
    – Ron Maupin ♦
    Nov 16 '17 at 1:37
  • 1
    Extended ACL... deny A from B
    – Ricky
    Nov 16 '17 at 1:59
  • By the way, please never use an image for text, like your configurations. Simply paste the text into your question, and use the Preformatted Text option ({}) on it.
    – Ron Maupin ♦
    Nov 16 '17 at 2:16
  • You look for the blue wire and cut it. See here How we doin over here! Spanning Tree Protocol IN DA HOUSE! LSA Type II up in dis biatch!
    – Ronnie Royston
    Nov 16 '17 at 2:53
1

As Ricky Beam points out, it is probably a better solution to use an extended ACL. As it is, you are using router resources to route the traffic from the source network to the router of the destination network before you drop it. You can create an extended ACL on Router2 and apply it to the incoming interface to drop any traffic destined for the 20.10.96.0/21 network.

Something like:

Router2:

ip access-list extended DROP
 deny ip any 20.10.96.0 0.0.7.255
!
interface FastEthernet 0/1
 ip access-group DROP in
!

The general rule is that you apply standard ACLs as close to the destination as possible in order to prevent dropping too much traffic, and extended ACLs should be placed as close to the source as possible in order to prevent wasting router resources routing traffic that is destined to be dropped anyway.

Improve this answer
1

On Router2:

ip access-list extended DROP
deny ip 200.190.64.0 0.0.0.15 20.10.96.0 0.0.7.255
permit ip any any

interface FastEthernet 0/1
ip access-group DROP in

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.