Access List/ Routing Question

[BVarwig]

Host A IP 192.23.21.5 255.255.255.0 gateway 192.23.21.254 VLAN 21

NVR IP 192.23.13.11 255.255.255.0 gateway 192.23.13.254 VLAN 13

Video storage 192.23.200.20 255.255.255.0 gateway 192.23.200.254 VLAN 200

All 3 devices connect directly into C9300 multilayer switch. Host A needs to be able to communicate with both the NVR and the Video storage devices on separate VLANs.

I have VLANs 21, 13, 200 built onto the switch. Each end device is configured with an access port with their associated vlan on the switch.

Don't even know where to begin.

[Devaa]

Based on your statement above, I have used single ACL to be called in both NVR and Storage VLAN, considering that will have to be secured. If you any other requirements, ACLs have to be modified accordingly. 

vlan 21,13,200
exit

ip routing

int G1/0/1
 description HOST-A
 switchport mode access
 switchport access vlan 21

int G1/0/2
 description NVR
  switchport mode access
 switchport access vlan 13

int G1/0/3
 description VIDEO-STORAGE
  switchport mode access
 switchport access vlan 200

int vlan 13
 ip add 192.23.13.254 255.255.255.0
 no shut

int vlan 21
 ip add 192.23.21.254 255.255.255.0
 no shut

int vlan 200
 ip add 192.23.200.254 255.255.255.0
 no shut

Before configuring ACLs, make sure Inter-VLAN routing is working as expected after configuring the VLAN interfaces by pinging NVR and Storage server from HOST-A. 

! From HOST-A: 
ping 192.23.13.11
ping 192.23.200.20

Configure ACLs: 

ip access-list extended ACL
 permit ip host 192.23.21.5 host 192.23.200.20
 permit ip host 192.23.21.5 host 192.23.13.11
 ! below lines can be ignored if not required
 deny ip any host 192.23.200.20
 deny ip any host 192.23.13.11
 permit ip any any


int vlan 21
 ip access-group ACL out

int vlan 200
 ip access-group ACL out

[BVarwig]

Seems like I'm having an error in the Inter VLAN routing portion. Here is my PT mockup.

[M02@rt37]

Hello @BVarwig 

Do you have configured the ip routing command ?

Check that port where endpoints are connected are up/up, SVI too.

[Devaa]

@BVarwig Inter VLAN routing works after below changes in your setup. Find attached file with fixed intervlan routing config

In Server: Configure IP part of VLAN 200 subnet

In Switch: Make the server port G1/0/1 part of VLAN 200

[M02@rt37]

@BVarwig 

AS I said,

SVIO 200 is up/down, so you cannot ping this Gw hosted on C9300

You need an endpoint in that vlan and configure its port in mode access vlan 200.

Also, as a best practice, configure a TRUNK link between C9300 and the NVR1 switch.