topic Re: Allow Specific VLAN traffic in Wireless

Allow Specific VLAN traffic

rsthakur — Mon, 17 Feb 2025 11:48:10 GMT

You have a 6805 switch with multiple VLANs and want to create an ACL to restrict access as follows:

Only VLAN 16 (172.28.40.0/21) and VLAN 30 (172.28.152.0/21) should be allowed to access VLAN 311 (172.23.0.0/21).
All other VLAN traffic to VLAN 311 should be denied.

i have configured the ACL

ip access-list extended VLAN311_ACCESS
permit ip 172.28.40.0 0.0.7.255 172.28.23.0 0.0.7.255
permit ip 172.28.152.0 0.0.7.255 172.28.23.0 0.0.7.255
deny ip any 172.28.23.0 0.0.7.255
permit ip any any

interface vlan 311
ip access-group VLAN311_ACCESS in

but this is not working.

Any Help.

Re: Allow Specific VLAN traffic

Flavio Miranda — Mon, 17 Feb 2025 12:07:33 GMT

@rsthakur

The only part you need is this. As ACL have deny any any at the end, only traffic for vlan 16 and 30 is allowed.

ip access-list extended VLAN311_ACCESS
permit ip 172.28.40.0 0.0.7.255 172.28.23.0 0.0.7.255
permit ip 172.28.152.0 0.0.7.255 172.28.23.0 0.0.7.255

You can also apply one ACL at vlan 16 and 30

ip access-list extended VLAN16_ACCESS
deny ip any 172.23.0.0 0.0.7.255
permit IP any any

interface vlan 16
ip access-group VLAN16_ACCESS out

Re: Allow Specific VLAN traffic

rsthakur — Thu, 20 Feb 2025 04:32:45 GMT

VLAN 30 (172.28.152.0/21) should be allowed to access VLAN 311 (172.23.0.0/21).
All other VLAN traffic to VLAN 311 should be denied.

Now, I have applied the command below.

ip access-list extended Camera
permit ip 172.28.152.0 0.0.7.255 172.23.0.0 0.0.7.255
deny ip any 172.23.0.0 0.0.7.255
deny ip any any

put the Above ACL on VLAN 311

interface Vlan311
description Extra Vlan
ip address 172.23.7.254 255.255.248.0
ip access-group Camera in

Then make one more ACL

ip access-list extended VLAN30_Camera
deny ip any 172.23.0.0 0.0.7.255
permit ip any any

and this one put on Vlan 30

interface Vlan30
description CC Lab & CC Management VLAN
ip address 172.28.159.254 255.255.248.0
ip access-group VLAN30_Camera out

But no luck, Its not working

Re: Allow Specific VLAN traffic

srimal99 — Thu, 20 Feb 2025 09:51:58 GMT

@rsthakur do you have reachability to those subnets from the switch ? and check the port status does it go in to err-disable state ?