12-14-2024 12:58 PM
Hello, I have below the file I have been working on
I am currently attempting to allow Executive/Management to communicate with any other network, which is working fine, except for its communication with Government & Production.
The goal here is to keep Government and Executive connected but separate while keeping Executive connected to everything else as well, so I tried using trunking.
But if I attempt to ping Executive (172.16.136.2) from Government (172.16.192.2) I get a destination unreachable.
Solved! Go to Solution.
12-14-2024 01:29 PM
You are not going to achieve this by using trunk or vlan. The best way to achieve this is using Access List. Keep the switch as a hub point allowing all the routers to have connective to which other.
Take a look on the file I attached. You can see that only Executive can ping governance, but executive can also ping anything else. While the other networks can not ping governance.
Pay attention that I put the access list on the internal interface of the router in Governance in the OUT direction. If I put on the external interface, I would block the RIP communication and the Governance network would be isolated from the rest.
12-14-2024 01:29 PM
You are not going to achieve this by using trunk or vlan. The best way to achieve this is using Access List. Keep the switch as a hub point allowing all the routers to have connective to which other.
Take a look on the file I attached. You can see that only Executive can ping governance, but executive can also ping anything else. While the other networks can not ping governance.
Pay attention that I put the access list on the internal interface of the router in Governance in the OUT direction. If I put on the external interface, I would block the RIP communication and the Governance network would be isolated from the rest.
12-14-2024 01:49 PM
Ah that's interesting to know, thank you! I have a follow-up question to using access list.
From what I can see looking at the show access-lists, it seems that if there are more hosts, I would have to manually add each and every one. From a little reading about access list https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html
Would it be correct to remove the 3 listed, and instead replace it with the following?
access-list 100 permit ip 172.16.136.0 0.0.7.255 any
12-14-2024 01:54 PM
@knei Yes, you can do that.
I actually added two host that was not necessary. The way you are proposing is way more efficient.
12-14-2024 01:55 PM
Thank you so much for your time!
12-14-2024 02:30 PM
You are welcome.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide