4

I have 5 departments each with it's own vlan and i want some of them to ping some of them, and only want some of them to ping some of them back. Basically creating a hierarchy of vlans.

enter image description here

Concretely, i need

vlan10 to ping all the other vlans 
vlan20 to ping all the other vlans
vlan30 to only ping vlan50
vlan40 to only ping vlan30 and vlan 50
vlan50 to ping none (only it's own vlan)

so to let vlan20 ping all the vlans and block vlan30, vlan40, and vlan50 from pinging it back, i did this

ip access-list extended BLOCK_ECHO_REQUEST_TO_VLAN20_IN
remark Block ICMP echo requests to VLAN 20
deny icmp any 172.16.32.0 0.0.31.255 echo
remark Permit all other traffic, including ICMP echo reply
permit ip any any
!
interface FastEthernet0/0.3
description FINANCA VLAN
ip access-group BLOCK_ECHO_REQUEST_TO_VLAN20_IN in
!
interface FastEthernet0/0.4
description ADMIN VLAN
ip access-group BLOCK_ECHO_REQUEST_TO_VLAN20_IN in
!
interface FastEthernet0/0.5
description OTHERS VLAN
ip access-group BLOCK_ECHO_REQUEST_TO_VLAN20_IN in
!

that works, but now if i want to do the same for vlan10 the first one gets cancelled, and i can still ping from vlan30, 40 and 50 to vlan20.

ip access-list extended BLOCK_ECHO_REQUEST_TO_VLAN10_IN
deny icmp any 172.16.0.0 0.0.31.255 echo
permit ip any any
!
interface FastEthernet0/0.3
description FINANCA VLAN
ip access-group BLOCK_ECHO_REQUEST_TO_VLAN10_IN in 
!  
interface FastEthernet0/0.4
description ADMIN VLAN
ip access-group BLOCK_ECHO_REQUEST_TO_VLAN10_IN in
!
interface FastEthernet0/0.5
description OTHERS VLAN
ip access-group BLOCK_ECHO_REQUEST_TO_VLAN10_IN in
!

Switch Configuration

interface FastEthernet0/1
switchport access vlan 10
!
interface FastEthernet0/2
switchport access vlan 20
!
interface FastEthernet0/3
switchport access vlan 30
!
interface FastEthernet0/4
switchport access vlan 40
!
interface FastEthernet0/5
switchport access vlan 50
!
interface FastEthernet0/6
switchport mode trunk
.
.
.
.
interface Vlan1
no ip address
shutdown
!
interface Vlan10
mac-address 0004.9aeb.4a01
ip address 172.16.0.100 255.255.224.0
!  
interface Vlan20
mac-address 0004.9aeb.4a02
ip address 172.16.32.100 255.255.224.0
!
interface Vlan30
mac-address 0004.9aeb.4a03
ip address 172.16.64.100 255.255.224.0
!
interface Vlan40
mac-address 0004.9aeb.4a04
ip address 172.16.96.100 255.255.224.0
!
interface Vlan50
mac-address 0004.9aeb.4a05
ip address 172.16.128.100 255.255.224.0

Router Configuration

Router Running Config - interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation dot1Q 10
ip address 172.16.0.50 255.255.224.0
ip access-group 1 in   
! 
interface FastEthernet0/0.2
encapsulation dot1Q 20
ip address 172.16.32.50 255.255.224.0
ip access-group 1 in
!
interface FastEthernet0/0.3
encapsulation dot1Q 30
ip address 172.16.64.50 255.255.224.0
!
interface FastEthernet0/0.4
encapsulation dot1Q 40
ip address 172.16.96.50 255.255.224.0
!
interface FastEthernet0/0.5
encapsulation dot1Q 50
ip address 172.16.128.50 255.255.224.0
  • 1
    If you want VLANs 10 an 20 to ping every VLAN, then you do not want an access list on those interfaces, so no ip access-group 1 in on those interfaces. Make a different ACL for each of the other interfaces that blocks in the way you want, and assign the ACLs to those interfaces. – Ron Maupin Jun 3 '18 at 17:34
  • yes that's what i did, but when you apply 2 access lists (different ones) on one interface (ex: block VLAN10 and VLAN20 on interface0/0.3), the first one get's canceled as soon as you apply the second one – gusgusjon Jun 3 '18 at 21:59
  • No, you need to make one ACL for each interface, and the ACL can have multiple lines. For example, you have one line to block echo requests to VLAN 10, and one line to block echo requests to VLAN 20. Then apply that ACL to VLAN 30. You are looking to customize what each ACL can do, so you need a custom ACL for each VLAN. – Ron Maupin Jun 3 '18 at 22:12
5

You can't have more than one access list per direction on an interface. So, to accomplish this, you will have to create a unique access-list for each interface that allows only the traffic you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.