0

I'm working on a project in packet tracer and I have a server connected to VLAN 10.

VLAN 10 has a single server device on it and the IP scope is a /30.

I have 8 other VLANs across 2 sites. The 2 sites are linked by a fibre link connected to 2 x packet tracer routers, and then connected to a 3650 24p switch.

There are 2 VLANs (VLAN 2 and 4) that should not have access to the server on VLAN 10.

VLAN 2 is subnetted 192.168.2.0/26 VLAN 4 is subnetted 192.168.4.0/26

EIGRP is set up across all routers and switches, and currently, all devices on the network can ping the server on 192.168.10.1. I need to block devices in the 2 above VLANs from communicating with the device in VLAN 10.

I have tried several different methods, and the closed that I have gotten is devices on VLANs 2 and 4 getting "Destination Host Unreachable", but then all other hosts the get "Request Timed Out" which is (obviously) undesired.

Below is what I programmed on the switch:

access-list 100 deny ip 192.168.2.0 0.0.0.63 192.168.10.0 0.0.0.3
access-list 100 deny ip 192.168.4.0 0.0.0.63 192.168.10.0 0.0.0.3
access-list 100 permit ip any 192.168.10.0 0.0.0.3

int vlan 10

ip access-group 100 in
ip access-group 100 out

All the above was entered into the 3650 switch on which VLAN10 resides.

2

I've realised as I was looking at my post, I hadn't denied the IPs from the 2 VLANs, but hadn't allowed the remaining VLANs to access. Added those in and it worked a treat.

AKA... Ignore this question, as I sorted it myself!

| improve this answer | |
  • You can accept your own answer so others can learn from it. – Ron Trunk Jul 4 at 15:08
  • Heed the implicit deny ip any any at any ACL's end! – Zac67 Jul 4 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.