Seperating Subnets

[knei]

Hello, I have below the file I have been working on
I am currently attempting to allow Executive/Management to communicate with any other network, which is working fine, except for its communication with Government & Production.
The goal here is to keep Government and Executive connected but separate while keeping Executive connected to everything else as well, so I tried using trunking.

But if I attempt to ping Executive (172.16.136.2) from Government (172.16.192.2) I get a destination unreachable.

[Flavio Miranda · Accepted solution]

@knei 

 You are not going to achieve this by using trunk or vlan. The best way to achieve this is using Access List. Keep the switch as a hub point allowing all the routers to have connective to which other.

Take a look on the file I attached. You can see that only Executive can ping governance, but executive can also ping anything else. While the other networks can not ping governance.

 Pay attention that I put the access list on the internal interface of the router in Governance in the OUT direction. If I put on the external interface, I would block the RIP communication and the Governance network would be isolated from the rest.

[knei]

Ah that's interesting to know, thank you! I have a follow-up question to using access list.
From what I can see looking at the show access-lists, it seems that if there are more hosts, I would have to manually add each and every one. From a little reading about access list https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html 
Would it be correct to remove the 3 listed, and instead replace it with the following?
access-list 100 permit ip 172.16.136.0 0.0.7.255 any

[Flavio Miranda]

@knei  Yes, you can do that.

  I actually added two host that was not necessary. The way you are proposing is way more efficient.

[knei]

Thank you so much for your time!

[Flavio Miranda]

You are welcome.