Help needed with creating VLAN Map

[MiltonConnor]

Hi all,

I need some help w.r.t setting up VLAN maps/ACL.

The following scenario is what I need:

Three VLANs - VLAN10, VLAN20, VLAN30

VLAN10 - Should be able to access all packets on VLAN20 and VLAN 30

VLAN20 - Should only be able to access VLAN10

VLAN30 - Should be able to access both VLAN10 and VLAN20

I am using a catalyst 2960 switch.

Thank you for your consideration.

[balaji.bandi]

you can start with VLAN ACL from below guide :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vacl.html

http://www.thepacketwizard.com/blog/2018/09/21/cisco-switch-vlan-acls-vacl/

Once you make the basic config if you stuck anywhere post the configuration here so we can help to tweak.

[pmckenzie]

here are the steps I would carry out for vlan 10.

1. create an access list on your switch (assuming your vlan 10 is 192.168.10.0 network)

access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.20.0. 0.0.0.255

access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.30.0. 0.0.0.255

2. create an access map for VLAN 10 allowed drop others

vlan access-map TO-VLAN-20-30

match ip address 100

allow

This will default to drop for anything else

3. apply VLAN filter

vlan filter 100 vlan-list 10

4. apply to interface(s)

int fa0/1

switchport capture

[paul driver]

Hello

switch
ip access-list extended no_vl30
deny ip 30.30.30.0 0.0.0.255 any
permit ip any any

int vlan 20
ip access-group no_vl30-10 OUT