3

Iam trying to block a certain host from sending any message to any host in the network is there is a way to do that or i have to deny host by host ?

5

deny ip 10.10.10.10/32 255.255.255.255/32 should do it for e.g. 10.10.10.10 as source.

If you want to filter multiple source IPs you need multiple ACL entries unless you can fit a mask to all sources.

For instance, deny ip 10.10.10.8/30 255.255.255.255/32 filters all broadcasts from hosts 10.10.10.8 through 10.10.10.11.

Note that wildcard masks needn't be contiguous like subnet masks. You could use deny ip 10.10.10.10 255.255.255.251 255.255.255.255/32 for sources 10.10.10.10 and 10.10.10.14.

3
ip access-list acl-01
Deny ip <destination IP> <destination wild card> host <source ip>
permit any any

Implementation should be done in interface and direction should be in/out but we cannot tell it exactly without seeing diagram.

ip access-group acl-01 in
0

If you even want to block the host from talking to hosts in the same IP-network you have to put a firewall on the host. Another way would be Private Vlan to isolate it and force every communication to go through the next hop (which could be a firewall).

  • this is not an answer for question – infra Jun 21 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.