VLAN ACL Dropping Certain Port

[AhmadZ]

Dear All,

I'm trying to configure VLAN ACL, I have VLAN10, VLAN20 and other vlans.

I want to drop everything from VLAN20 to all other VLANs except for a specific port on an IP on VLAN10.

How can I do that?

I've seen several configurations, but still not working,

Thanks in advance!

[Flavio Miranda · Accepted solution]

Do like this

 You need to create an Access List allowing the port you need.

Then, you need to apply this Access List on vlan 20.

ip access-list extended acl_Vlan_Filter

permit tcp any .255 host 20.20.20.x  eq www

You need to assign an Ip address to this vlan:

interfaca vlan 20

ip add 20.20.20.1 255.255.255.0

ip access-group acl_Vlan_Filter in

[AhmadZ]

I've been seeing VLAN access map, where the action is drop or forward, I don't see VLAN access map in your config.

What I really want is that I want to stop everything from VLAN20 to all other VLANs except for a specific port on an IP on VLAN10

Thanks!

[Flavio Miranda]

You are talking about policy but you dont need it to drop traffic in a vlan. Access List is enough.

[AhmadZ]

Yeah, I just want to deny everything from VLAN20 to all VLANs except specific port for a host on VLAN10

[Flavio Miranda]

Then, do just like I told you. I have this all around my network.

[AhmadZ]

I tried, but I applied this: ip access-group acl_Vlan_Filter out instead of this ip access-group acl_Vlan_Filter in,

Because the traffic is going out from vlan 20, so I want to apply ACL from the packets coming from VLAN20, and it seems it's working.

is this right?

[Richard Burts]

If it seems to be working that is a good thing. Since we do not know specifics of what you configured it is difficult for us to say whether it is right or not.

One principle that sometimes surprises people who are just learning about access lists is that it is a 2 stage process. First you must configure the access list, and second you must apply the access list to the interface. And in the beginning some people do not understand about whether to apply the acl in or out. The answer depends on the source and destination addresses specified in the acl. If the local lan addresses are the source addresses in the acl then traffic from hosts in the network is coming into the interface of the switch/router and the acl is applied as in. If the local lan addresses are the destination addresses in the acl then traffic is going from the switch/router interface out to the hosts and the acl is applied as out.

[AhmadZ]

Yeah I asked if it's correct although it's working because I want to make sure that this is the right way to do it. Thanks for the clarification. In my case, both vlans are on the same coreswitch, so ACL is applied from local lan to local lan which is VLAN to VLAN.

Thanks!

[Flavio Miranda]

I understood that you want to protect something inside vlan 20 (A server or any other device). When dealing with Access List, imagine yourself inside something. If you are inside the vlan 20 and you want to protect yourself from something coming from outside, then you need to add the access-group as IN.

 You can use OUT if you want the opposite. I mean, you want to protect something  FROM something inside vlan 20. Hope that helps.

[AhmadZ]

I'm trying to have one-way direction from a host in VLAN20 to a host in VLAN10, and all other packets to be dropped.

That's what I'm trying to achieve

[MHM Cisco World]

action drop or forward ? you talk about the PACL not VACL, there is different.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vacl.html

port you taking about is physical not L4 port ?

if that right see the above guide how config the PACL.
PACL is applied only in one direction INBOUND 

[AhmadZ]

the port is not physical, I meant specific port on specific host on VLAN10.

So I want to block all traffic coming from VLAN20 to all others VLANs except for specific port on a host that is in VLAN10

[MHM Cisco World]

""So I want to block all traffic coming from VLAN20 to all others VLANs except for specific port on a host that is in VLAN10""

ip access-list extended Vlan-Filter

permit L4 VLAN20 host VLAN10  L4Port

!

interfaca vlan 20

ip add VLAN20

ip access-group Vlan-Filter IN <- IN not OUT 

[Richard Burts]

In the suggestion by @MHM Cisco World vlan 20 is the source address and vlan 10 is the destination address. If the access-group is applied on interface vlan 20 then it needs to be applied IN and not OUT.