ACL on Guest Vlan

[npagadua69]

I would like to deny this network from seeing all of the other network. i am not sure if i am doing this correctly. please advise.

access-list 101 deny ip 192.168.99.0 0.0.0.255 192.0.0.0 0.0.0.255

I dont want 192.168.99.0 to see all of the 192.0.0.0 segment. please advise.

[shijogeorge]

Hi,

What is the subnet mask of the network to which you want to deny access?

If it is 192.0.0.0/8, the access list should be as follows.

access-list 101 deny ip 192.168.99.0 0.0.0.255 192.0.0.0 0.255.255.255

Regards,

Shijo George.

[npagadua69]

thanks

[thisisshanky]

If using DHCP for guest vlan, try using a DNS server in the DHCP scope defined for guest vlan, as an external (public) DNS server IP. Do not provide your internal DNS Server as part of the scope, because this will let the guest user hack into your network through your DNS server. (Obviously then you will have to permit communication from guest subnet to your internal DNS server, which is not a good thing to do)