I am having a bunch of VLANS that are in our HQ. Idea is that only several subnet must see IT department VLAN and all others DONT but IT department must see all vlans.

I tried like this, to make all extended acl for all vlans

Extended IP access list FILTER_VLAN_25
10 deny ip any (648975 matches)
20 permit ip any any (43833968 matches)
30 permit icmp any any

and vlan 50 (which is IT department)

Extended IP access list FILTER_VLAN_50
10 permit ip any any (76171578 matches)
20 permit icmp any any

So when i tried to ping from that vlan 25, i can see subnet in vlan 50. Why? I tried to add block rule in ext acl FILTER_VLAN_25 where i deny but then i cant also access from VLAN 50

and ip access-group is IN for all those VLAN interefaces.

  • Unfortunately, your question does not have enough detail to answer. Please include ag good network description or diagram, the network device models, and the full (sanitized) network device configuration. We cannot simply guess where you may have gone wrong.
    – Ron Maupin
    Jun 18, 2021 at 23:05
  • Generally, ACLs are stateless. Therefore, you need to use permit returning traffic as well.
    – Zac67
    Jun 19, 2021 at 8:19
  • so firewall is creating dhcp, cisco 3750 is holding vlans, and those vlans helper ip is firewall ip, and from there goes to access switches (sg220) and to the offices. Jun 19, 2021 at 13:08


Browse other questions tagged or ask your own question.