1

I have default route setup as

ip route 0.0.0.0/0 172.16.15.2 

where 172.16.15.2 is internet connected router with NAT. Here is some snippet of the router configuration:

interface GigabitEthernet0/1.1
 encapsulation dot1q 10
 ip address 172.16.10.1 255.255.255.0 
# 
interface GigabitEthernet0/1.2
 encapsulation dot1q 20
 ip address 172.16.20.1 255.255.255.0
#
interface GigabitEthernet0/1.3
 encapsulation dot1q 15
 ip address 172.16.15.1 255.255.255.252
 ip access-group 101 out
#
access-list 101 deny ip 172.16.11.0 0.0.0.255 172.16.15.2 0.0.0.3 
access-list 101  permit ip any any 
 ip route 0.0.0.0/0 172.16.15.2 

I want internet to be allowed only for 172.16.10.0, but not for 172.16.11.0. The ACL applied on outbound interface of fa0/1.3 is not working. Is there any other solution that prevents traffic to be forwarded to 172.16.15.2 ?

0

1 Answer 1

2

access-list 101 deny ip 172.16.11.0 0.0.0.255 0.0.0.0 255.255.255.255 should work - deny when source is 172.16.11.0/24 and destination is anything. Note that ACLs have an implied deny ip any any at the end.

If this is too restrictive - denies other private subnets as well - you need to allow those before:

100 permit ip 172.16.11.0 0.0.0.255 172.16.0.0 0.15.255.255
110 deny ip 172.16.11.0 0.0.0.255 0.0.0.0 255.255.255.255
9999 permit ip any any

Or more generally, permit all traffic within 172.16.0.0/12 but deny 172.16.11.0/24 traffic to elsewhere:

100 permit ip 172.16.0.0 0.15.255.255 172.16.0.0 0.15.255.255
110 deny ip 172.16.11.0 0.0.0.255 0.0.0.0 255.255.255.255
9999 permit ip any any
1
  • This solution helped me: 100 deny ip 172.16.11.0 0.0.0.255 0.0.0.0 255.255.255.255 100 permit ip any any and ip access-group 100 out in interface fa0/1.3 ` Feb 8, 2019 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.