Iam trying to block a certain host from sending any message to any host in the network is there is a way to do that or i have to deny host by host ?

3 Answers 3


deny ip should do it for e.g. as source.

If you want to filter multiple source IPs you need multiple ACL entries unless you can fit a mask to all sources.

For instance, deny ip filters all broadcasts from hosts through

Note that wildcard masks needn't be contiguous like subnet masks. You could use deny ip for sources and

ip access-list acl-01
Deny ip <destination IP> <destination wild card> host <source ip>
permit any any

Implementation should be done in interface and direction should be in/out but we cannot tell it exactly without seeing diagram.

ip access-group acl-01 in

If you even want to block the host from talking to hosts in the same IP-network you have to put a firewall on the host. Another way would be Private Vlan to isolate it and force every communication to go through the next hop (which could be a firewall).

  • this is not an answer for question
    – infra
    Commented Jun 21, 2019 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.