Question about ACL

[JohnyJo123]

Hi community i have questions about how to use ACL !

I have this network

the network on vlan 10 is 10.1.1.0

and vlan 20 is 10.1.2.0

I need to set up a ACL to block access computers in the VLAN 10 the condition is : VLAN 10 can access to intranet but cannot access to internet

Here what i got :

ACL :

deny tcp 10.1.1.0 any eq 80

deny tcp 10.1.1.0 any eq 443

and after that i will put the access-list to my interfaces poiting inside with nat inside and the interface pointing outside with nat outside

Whats do you think ?

Thanks you

[balaji.bandi · Accepted solution]

example config help you to get an idea, only add VLAN20 IP to NAT, so VLAN 10 will dropped and not natted. so no internet for VLAN 10.

configure t
!
ip routing
!
interface Gig0/0
ip addresss x.x.x.x 255.255.255.0
ip nat outside
!
interface Gig0/1
ip addresss y.y.y.y 255.255.255.0
ip nat inside
!
ip route 0.0.0.0 0.0.0.0 x.x.x.X (external ISP IP)
!
access-list 100 permit ip 10.1.2.0 0.0.0.255 any
ip nat inside source list 100 interface Gig0/0 overload
!

Some config may change if you have VLAN SVI, so adjust the config accordingly.

[JohnyJo123]

Thank you ! I appreciate it

[balaji.bandi]

most welcome, is that suggestion works for you ?

[JohnyJo123]

Yes it does !

[balaji.bandi]

glad all working as expected and we mark it as a solution now.