0

Good day

Is there a way to block a specific port in a Cisco Catalyst 3560 switch to block the user from accessing the internet but still have full access to the internal corporate resources. The internet is supplied from a port connected to a separate third party router with only internet functionality. The Cisco Catalyst 3560 supply the DHCP to the network at the moment. I also do have a third party WIFI access point connected to the switch. The ports that I need to block is static ports on the Cisco switch itself.

Switch#show running-config
Building configuration...

Current configuration : 9347 bytes
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
enable secret xxx
!
username admin privilege 15 secret xxx
no aaa new-model
clock timezone UTC 2 0
system mtu routing 1500
vtp mode transparent
ip name-server 255.255.255.0
!
!
ip dhcp pool v10
 network 192.168.8.0 255.255.255.0
 default-router 192.168.8.253
 dns-server 192.168.8.253
!
ip dhcp pool v12
!
ip dhcp pool v11
!
!
!
mls qos map cos-dscp 0 8 16 24 32 46 48 56
mls qos srr-queue input bandwidth 70 30
mls qos srr-queue input threshold 1 80 90
mls qos srr-queue input priority-queue 2 bandwidth 30
mls qos srr-queue input cos-map queue 1 threshold 2 3
mls qos srr-queue input cos-map queue 1 threshold 3 6 7
mls qos srr-queue input cos-map queue 2 threshold 1 4
mls qos srr-queue input dscp-map queue 1 threshold 2 24
mls qos srr-queue input dscp-map queue 1 threshold 3 48 49 50 51 52 53 54 55
mls qos srr-queue input dscp-map queue 1 threshold 3 56 57 58 59 60 61 62 63
mls qos srr-queue input dscp-map queue 2 threshold 3 32 33 40 41 42 43 44 45
mls qos srr-queue input dscp-map queue 2 threshold 3 46 47
mls qos srr-queue output cos-map queue 1 threshold 3 4 5
mls qos srr-queue output cos-map queue 2 threshold 1 2
mls qos srr-queue output cos-map queue 2 threshold 2 3
mls qos srr-queue output cos-map queue 2 threshold 3 6 7
mls qos srr-queue output cos-map queue 3 threshold 3 0
mls qos srr-queue output cos-map queue 4 threshold 3 1
mls qos srr-queue output dscp-map queue 1 threshold 3 32 33 40 41 42 43 44 45
mls qos srr-queue output dscp-map queue 1 threshold 3 46 47
mls qos srr-queue output dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23
mls qos srr-queue output dscp-map queue 2 threshold 1 26 27 28 29 30 31 34 35
mls qos srr-queue output dscp-map queue 2 threshold 1 36 37 38 39
mls qos srr-queue output dscp-map queue 2 threshold 2 24
mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55
mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63
mls qos srr-queue output dscp-map queue 3 threshold 3 0 1 2 3 4 5 6 7
mls qos srr-queue output dscp-map queue 4 threshold 1 8 9 11 13 15
mls qos srr-queue output dscp-map queue 4 threshold 2 10 12 14
mls qos queue-set output 1 threshold 1 100 100 50 200
mls qos queue-set output 1 threshold 2 125 125 100 400
mls qos queue-set output 1 threshold 3 100 100 100 400
mls qos queue-set output 1 threshold 4 60 150 50 200
mls qos queue-set output 1 buffers 15 25 40 20
mls qos
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 10
 name Lan1
!
vlan 11
 name Internet
!
vlan 12
 name LAN2
!
vlan 13
 name Privatevlan
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel7
 description port7
!
interface Port-channel48
!
interface GigabitEthernet0/1
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/2
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/3
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/4
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/5
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/6
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/7
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/8
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/9
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/10
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/11
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/12
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/13
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/14
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/15
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/16
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/17
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/18
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/19
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport mode access
!
interface GigabitEthernet0/20
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/21
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/22
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/23
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/24
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/25
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/26
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/27
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/28
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/29
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/30
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/31
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/32
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/33
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10
 switchport trunk pruning vlan 10
 switchport private-vlan host-association 12 10
 switchport mode access
 srr-queue bandwidth share 1 30 35 5
 priority-queue out
 mls qos trust dscp
 auto qos trust
 macro description cisco-router
 spanning-tree portfast trunk
 spanning-tree bpduguard enable
!
interface GigabitEthernet0/34
!
interface GigabitEthernet0/35
!
interface GigabitEthernet0/36
!
interface GigabitEthernet0/37
!
interface GigabitEthernet0/38
!
interface GigabitEthernet0/39
!
interface GigabitEthernet0/40
!
interface GigabitEthernet0/41
!
interface GigabitEthernet0/42
!
interface GigabitEthernet0/43
!
interface GigabitEthernet0/44
!
interface GigabitEthernet0/45
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 10
 switchport mode access
!
interface GigabitEthernet0/46
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 10
 switchport mode access
!
interface GigabitEthernet0/47
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 10
 switchport mode access
!
interface GigabitEthernet0/48
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 12
 switchport trunk allowed vlan 11
 switchport trunk pruning vlan 10
 switchport private-vlan mapping 12 11,13
 switchport mode access
!
interface GigabitEthernet0/49
!
interface GigabitEthernet0/50
!
interface GigabitEthernet0/51
!
interface GigabitEthernet0/52
!
interface Vlan1
 ip address 192.168.7.1 255.255.255.0
!
interface Vlan10
 ip address 192.168.8.100 255.255.255.0
!
interface Vlan11
 ip address 192.168.9.101 255.255.255.0
 shutdown
!
interface Vlan12
 no ip address
!
ip default-gateway 192.168.7.253
ip http server
ip http authentication local
ip http secure-server
!

Port 1 - 32 is in v-lan 10 to accommodate the network. all my devices is currently connected to vlan 10. my dhcp range is 192.168.8.xxx.

  • Yes this is possible, but you will need to supply us with a lot more information. What is your current switch configuration? Do you have a simple network diagram or drawing showing your network design? What software are you currently running on your switch? – user36472 Feb 21 at 7:45
  • I will do that quickly. Port 1 - 32 is in v-lan 10 to accommodate the network. all my devices is currently connected to vlan 10. my dhcp range is 192.168.8.xxx will add the drawing just now. – Andre Smit Feb 21 at 7:50
  • Also, please add the switch configuration, but remember to remove passwords or sensitive information. Just copy paste and format it as code using {} around it. – user36472 Feb 21 at 7:56
  • how do i add a txt doc in here – Andre Smit Feb 21 at 8:07
  • You cant, just copy/paste the text. You can add images, but i do not recommend adding a picture of your configuration. – user36472 Feb 21 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.