our network infrastructure as showing the image below

enter image description here

I had to give an external company (dealing with Face recognition) software an access to both the server ( and the IP Camera ( which are existed in our LAN 172.26.x.x/16 as showing.

their access has to be only permitted on these 2 machines and to the internet. -gateway IP (Cisco ASA internal): -DNS 1 IP: -DNS 2 IP:

I have configured an ACL to allow their access only to (IP Camera,Server,Internet)and applied the ACL on the trunk port Fa0/19 connecting between access switch 1 & access Switch 2 as per below knowing that STA6-2 is Access Switch 1 in the diagram:

enter image description here

enter image description here

enter image description here ................................... the problem is that after applying the ACL , server still have access to other resources on the LAN (example My PC

enter image description here

so please enlighten me on how to fix this.

Regards, Ethem

  • Did you end your ACL with deny any any? The switch reads the ACL from top to bottom, if no condition matches, then it will permit everything unless you have specified a deny any. Also please never post pictures of configurations, you should add the config as text with {} quotation around it. – user36472 Feb 16 '18 at 12:40
  • @Cown AFAIK, every ACL, that have at least one rule, will have implicit deny in the end, so explicit deny ip any any is only needed for a) tracking hit-count, b) logging denies. – Andrey Prokhorov Dec 12 '18 at 7:19
  • @AndreyProkhorov you are correct i must have been drunk or something... :D – user36472 Dec 12 '18 at 9:08

Your mistake is that the trunk interface is a layer-2 interface, but you are trying to apply a layer-3 ACL. Layer-2 switching doesn't look at the layer-3 addressing, which is what your ACL is using. You need to apply the ACL to a layer-3 (SVI) interface.

The point of VLANs is that traffic cannot get from one VLAN to another VLAN, except through a router (or routing module in a layer-3 switch). A trunk keeps traffic in each VLAN separate, just as if you had separate physical switches, by tagging the frames with VLAN tags.

Routing will, by default, route traffic from one VLAN to another, but you can place ACLs in the routed interfaces (those with IP addresses assigned to them) to allow or block specific traffic.

You are using extended ACLs, so you should place them as close to the traffic source as possible.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.