1

I have a Cisco 891F router. The internet is hooked up to G8. The student network is Vlan 200, and the Office is Vlan 100.

(I know the internet has an internal subnet (192.168.1.5), but that's because I'm testing in the lab.)

So the situation is that I have the internet on G8, and a classroom on vlan 200, with the office staff on vlan 100. I'm using NAT, actually, PAT, for each internal network and all is working well for internet access from both internal networks.

However, I need to add an ACL so that the 192.168.200.0/24 student network (vlan 200) can not see anything in the 192.168.151.0/24 office network (vlan 100).

I have not been able to find or work through anything with the "deny" along with the NAT that has the limited access described above.

Here is the interface and acl config: (any help is appreciated) -T

interface GigabitEthernet0
 switchport access vlan 100
 no ip address
!
interface GigabitEthernet1
 switchport access vlan 200
 no ip address
!
interface GigabitEthernet2
 no ip address
!
interface GigabitEthernet3
 no ip address
!
interface GigabitEthernet4
 no ip address
!
interface GigabitEthernet5
 no ip address
!
interface GigabitEthernet6
 no ip address
!
interface GigabitEthernet7
 no ip address
!
interface GigabitEthernet8
 description To Internet
 ip address 192.168.1.5 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
!
interface Vlan100
 description Office Network
 ip address 192.168.151.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
interface Vlan200
 description Student Network
 ip address 192.168.200.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
interface Async3
 no ip address
 encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 10 interface GigabitEthernet8 overload
ip nat inside source list 20 interface GigabitEthernet8 overload
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
access-list 10 permit 192.168.151.0 0.0.0.255
access-list 20 permit 192.168.200.0 0.0.0.255
!
2
  • NAT is not a substitute for routing. You do not use NAPT (PAT is a Cisco-specific term for NAPT) between private networks unless you have overlapping network addressing, which should only be a temporary situation until you can re-address. You only use NAPT where you must (private to public or overlapping addressing).
    – Ron Maupin
    Sep 4 at 22:22
  • Thank you Ron. You are right, and your comment made me step back an reevaluate the network structure.
    – TBone
    Sep 7 at 13:17
3

First of all, you don't use NAT between private subnets. You only use NAT when it is required, most prominently between private and public subnets.

If you do use (source) NAT, you can't filter in the destination subnet because all you see is the NATed router's IP address.

The syntax for basic ACLs is

permit|deny <sourcesubnet> <sourcewildcard> <destinationsubnet> <destinationwildcard>

Remember that there's always an implied deny any any at each ACL's end. If you don't want that to catch everything that you haven't explicitly defined, use a permit any any at the end.

I need to add an ACL so that the 192.168.200.0/24 network (vlan 200) can not see anything in 192.168.151.0/24 (vlan 100).

With permitting everything else, that'd be

1000 deny 192.168.200.0 0.0.0.255 192.168.151.0 0.0.0.255
9999 permit any any

Put that as in rule on the ingress port(s) for VLAN 200 or on VLAN 200 itself, depending on the router's capabilities.

Currently,

access-list 10 permit 192.168.151.0 0.0.0.255
access-list 20 permit 192.168.200.0 0.0.0.255

you're permitting those two subnets access to everywhere (that's what my less specific permit any any does, but for any source subnet). That's absolutely fine, but for the desired filtering to take place, you need to deny subnet 192.168.200.0/24 access to 192.168.151.0/24 before (ie. with maximum line number 19) permitting everything - remember that ACL rules are applied on a first-hit base, top to bottom.

5
  • Thanks, Zac. I updated the question so that I hope it is a little clearer.
    – TBone
    Sep 4 at 22:34
  • Thanks again, Zac. I listened to what you said and what Ron Maupin said and took a step back to look at the overall network. Although it's a very simple network and I am familiar with networking, I'm a noob on this equipment. The nat/pat is easy to understand, but I am still trying to reach my "Ah-Ha" moment with ACL's. That said, I have 2 ways to go, I think: My ISP equipment is doing NAT already, so I could just use the 891F as a simple router with 3 networks - one to the ISP and 2 locals. Or change the ISP to bridged and use the nat solution on the router. But that will have to wait.
    – TBone
    Sep 7 at 13:15
  • I'd always NAT towards the ISP router (for security) - if that router can work in bridged mode it'd simplify things (when you need destination NAT from public to private). You can NAT with the 891F towards the WAN (ISP router link), but not between different (V)LAN interfaces. I'm not very Cisco-savvy but the way you've defined NAT (both VLANs inside) should rule out NAT between them.
    – Zac67
    Sep 7 at 13:44
  • Your response clarifies a misgiving that I think you have regarding my original question. I'm not trying to NAT between the internal VLans. I am NATing toward the ISP. But I have two internal VLans which represent two different internal subnets. I successfully set up both of them as NAT internal. The only thing I couldn't figure out is how to make it so that one of the subnets was unable to see the other.
    – TBone
    Sep 7 at 14:05
  • @TBone All good - I posted the answer before you added the configurations and just wanted to make sure we're on the same page. The ACL rules above should block that inter-VLAN access between VLANs - if you've got more questions just come back here. ;-)
    – Zac67
    Sep 7 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.