3

enter image description hereI have a building with some departments and each department has it's own vlan and subnet. so now all departments can communicate with each other, but i only want some of them to communicate with some. or want some to communicate with some but not the other way around. can i use access lists to block some vlans to talk to others, if so how do i do that?

I need some vlans to communicate with some vlans (ex: i want It (vlan20) to have access everywhere but only ceo(vlan10) to have access to It.

Router Running Config - interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation dot1Q 10
ip address 172.16.0.50 255.255.224.0
ip access-group 1 in   
! 
interface FastEthernet0/0.2
encapsulation dot1Q 20
ip address 172.16.32.50 255.255.224.0
ip access-group 1 in
!
interface FastEthernet0/0.3
encapsulation dot1Q 30
ip address 172.16.64.50 255.255.224.0
!
interface FastEthernet0/0.4
encapsulation dot1Q 40
ip address 172.16.96.50 255.255.224.0
!
interface FastEthernet0/0.5
encapsulation dot1Q 50
ip address 172.16.128.50 255.255.224.0


Switch Running Config -
interface FastEthernet0/1
switchport access vlan 10
!
interface FastEthernet0/2
switchport access vlan 20
!
interface FastEthernet0/3
switchport access vlan 30
!
interface FastEthernet0/4
switchport access vlan 40
!
interface FastEthernet0/5
switchport access vlan 50
!
interface FastEthernet0/6
switchport mode trunk

.
.
.
.
interface FastEthernet0/1
switchport access vlan 10
!
interface FastEthernet0/2
switchport access vlan 20
!
interface FastEthernet0/3
switchport access vlan 30
!
interface FastEthernet0/4
switchport access vlan 40
!
interface FastEthernet0/5
switchport access vlan 50
!
interface FastEthernet0/6
switchport mode trunk
Improve this question
2
  • Yes, you can use ACLs in the router to permit or deny traffic between VLANs, which is one of the primary reasons to have VLANs. You have not given us enough information to give you any specifics. Edit your question to include the router configurations, and explain what you want to allow or deny between which VLANs.
    – Ron Maupin ♦
    Jun 2, 2018 at 16:19
  • "I need some vlans to communicate with some vlans (ex: i want It (vlan20) to have access everywhere but only ceo(vlan10) to have access to It." What you mean by "have access to it?" You permit or deny traffic, and you need to lay out specifics of what types of traffic you want to permit or deny, in which direction. Start a chart of each interface, then fill it in with the information. You need to think about things like bidirectional protocols. For example, if you blanket deny traffic from VLAN 30 to VLAN 20, then even if VLAN 20 can make requests to VLAN 30, VLAN 30 cannot reply to VLAN 20.
    – Ron Maupin ♦
    Jun 2, 2018 at 16:43

1 Answer 1

Reset to default
1

You have not given us much to go on. My example will concentrate on ICMP echo requests and replies (ping), but it permits any other traffic types, and you will need to extrapolate for anything else.

With standard access lists, you want to place those as close to the destination as possible in order to avoid in inadvertently blocking traffic that should be allowed. You cannot use standard access lists for specific types of traffic.

With extended access lists, you want to place them as close to the traffic source as possible in order to avoid wasting router resources by routing traffic that is destined to be discarded. Extended access lists can be very granular in the traffic types, sources, and destinations.

Access lists will be processed in order, and the processing will halt as soon as there is a match. Also, remember that access lists have an implicit deny any at the end, so you must explicitly permit anything you want to allow.

For example, let's block every VLAN, except VLAN 10, from sending ICMP echo requests to VLAN 20:

ip access-list extended BLOCK_ECHO_REQUEST_TO_VLAN20_IN
 remark Block ICMP echo requests to VLAN 20
 deny icmp any 172.16.32.0 0.0.31.255 echo
 remark Permit all other traffic, including ICMP echo reply
 permit ip any any
!
interface FastEthernet0/0.3
 description FINANCA VLAN
 ip access-group BLOCK_ECHO_REQUEST_TO_VLAN20_IN in
!
interface FastEthernet0/0.4
 description ADMIN VLAN
 ip access-group BLOCK_ECHO_REQUEST_TO_VLAN20_IN in
!
interface FastEthernet0/0.5
 description OTHERS VLAN
 ip access-group BLOCK_ECHO_REQUEST_TO_VLAN20_IN in
!

On every VLAN, except VLAN 10, we are dropping inbound echo requests destined to VLAN 20. VLAN 20 can still send echo requests to all other VLANs, and the other VLANs can still send echo replies back to VLAN 20.

Improve this answer
4
  • Wow this works!! I've been looking online for days man, thank you!! What I don't get is the 0.0.31.255, is that supposed to be the wild card? How do i find that for each of my vlans?
    – gusgusjon
    Jun 2, 2018 at 18:05
  • one more thing, so when I do this for other vlans, the first one gets canceled, for example i tried doing the same for vlan 30, so that vlan10 and 20 can ping it, and vlan 40 and 50 can not. What else would i need to change besides access list name, ip address, and the sub interfaces? Do i need to add something to the permit statement?
    – gusgusjon
    Jun 2, 2018 at 23:51
  • I'm not understanding. What I gave you would allow VLANs 10 and 20 to ping VLAN 30, but VLAN 30 could not ping VLAN 20. Remember that doing nothing allows you to ping. You may want to start a new question, but you need to give us your configuration.
    – Ron Maupin ♦
    Jun 2, 2018 at 23:57
  • basically what if i now also want to block vlan 30 from pinging both vlan 20 (which you did) and vlan10. can't i just do the same thing as you did and just change the ip to that of vlan10 and then apply it to the fa0/0.3 interface? okay, i'll make another question with all the vlans i want to ping each other and the ones i don't
    – gusgusjon
    Jun 3, 2018 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.