I am working with a series 800 router which has inbuilt switchports.

I want to use 2 switchports for a VLAN (say VLAN 100).

On one port will have devices:


Connected to the other port will be:


I want:

  • to be only able to talk to
  • to be only able to talk to an IP on another network (say

looking at the options, I cannot seem to find a way of applying an ACL like you usually would on a Cisco Switch (at interface level). So the next level is a VACL, which appears to be OK to use.

What I want to know is, will the VACL give me the segregation I require? or is there a better way to segregate traffic as I require?

1 Answer 1


This answer focuses on the following part:

or is there a better way to segregate traffic as I require?

Overall, it might turn out to be easier to run two internal VLANs with each their SVI (interface vlan XXX) with each their own subnet, and accepting the (possibly still small) disadvantage of having to renumber some hosts.

If you do, instead of trying to use a feature restricted built-in switch's functionality, you can resort to the "classic" and more flexible features the router has to offer: interface access lists, CBAC firewall, ZoneBasedFirewall (ZBFW), etc.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.