VLAN Routing

[Sureshdank]

Dear all,

I have configured multiple vlans on my 4506 switch. One of the vlan ip subnet is 172.18.1.0/255.255.255.0 and vlan interface ip address is 172.18.1.1( Every systems gateway in that vlan)

Now what I want is to allow only ips from 172.18.1.2 to 172.18.1.50 to communicate with other vlans and where as 172.18.1.51 to 172.18.1.254 not to communicate with other vlans.

Can any body tell would vlan acls or extented acls will be the right choice. If any then the config what should I do.

[devang_etcom]

i think you can configure as per your requirement using IP acl...by just denying the perticular ip to access that perticular vlan...

regards

Devang

[Sureshdank]

Devang,

Actually I want 172.18.1.2 to 172.18.1.50 to reach any traffic. But when you come to 172.18.1.51 to 172.18.1.254 I want them to reach only two vlans and remaning traffic need to be deny.

What could be the right configuration.

[rameshwarhiwale]

IP acls are right.

[royalblues]

Ramesh,

you can use IP access-lists but considering your requirement there will be a lot of access-lists entries because it will be difficult to choose a wildcard mask for your requirement.

You may have too rethink on the IP design before you want to apply ACLS.

HTH

Narayan

[Sureshdank]

Dear all,

I have applied the below access-list and applied on the vlan interface.

ip access-list extended ota-acc

1 permit ip 172.18.1.0 0.0.0.64 any

2 permit ip 172.18.1.0 0.0.0.255 192.168.249.0 0.0.0.255

3 permit ip 172.18.1.0 0.0.0.255 172.20.0.0 0.0.255.255

4 deny ip any any

But it dosent work.

Regards,

[devang_etcom]

hi suresh...

we can try route maps also...

where you are going to be use access-list where you permit your hosts...then you will configure the route-maps with deny key word where you are matching the ip address of the access-list and then you can set their next hop as null0 interface it means disacrding...

lets try it...

rate this post if it works

regards

Devang

[Sureshdank]

Devang,

I will explain you the complete scenario,

I have vlan with IP subnet 172.18.1.0/24. In this I want 50 IPs to get everything i.e. DMZ, Internet, Inter Vlan through my proxy server but for remaning IPs I want them to access only my server farm and Inter vlan without proxy.

For this what I have done is I have applied the ip access-list which I shown in my last post and then I have created route-map to route the permited packets to next hop.

Regards,