Acl configuration help for a beginner

[Derek Endale]

Ensure the web server can only access the internet and not other subnets using ACL. Place the web server in a DMZ.

I have 3 vlans connected to subinterfaces, the DMZ is in vlan 40 im trying to restrict it from accessing the other networks in vlan 10 and 20, on 192.168.10.x and 192.168.20.x but i still want the DMZ in 192.168.40.x to access the internet how would i configure this with ACLs? Subinterfaces are 0.0.0/10 - 0.0.0/20 - 0.0.0./40

[Flavio Miranda]

@Derek Endale 

Deny vlan 10 and 20, permit everything else

ip access-list extended DMZ
deny ip 192.168.10.0 0.0.0.255  any
deny ip 192.168.20.0 0.0.0.255 any 
permit ip any any

Apply the ACL on subinterface  0.0.0./40

[Derek Endale]

It seems like i can still ping from vlan 40 to the other vlans like 192.168.10.x computers and 192.168.20.x computers.

[Flavio Miranda]

@Derek Endale 

How did you apply?

Is It a PacketTracer? Can I see the project?

[Derek Endale]

ip access-list extended DMZ-Day4

deny ip 192.168.10.0 0.0.0.255 any

deny ip 192.168.20.0 0.0.0.255 any

permit ip any any

I applied it on int g0/0/0.40 with ip access-group DMZ-Day4 in

interface GigabitEthernet0/0/0.10

encapsulation dot1Q 10

ip address 192.168.10.1 255.255.255.0

ip access-group 140 in

!

interface GigabitEthernet0/0/0.20

encapsulation dot1Q 20

ip address 192.168.20.1 255.255.255.0

!

interface GigabitEthernet0/0/0.40

encapsulation dot1Q 40

ip address 192.168.40.1 255.255.255.0

ip access-group DMZ-Day4 in

[Flavio Miranda]

@Derek Endale

Apply in OUT direction

Or apply in IN but on internet 10 and 20.

[paul driver]

Hello
try-

ip access-list extended DMZ-Day4
deny ip  any 192.168.10.0 0.0.0.255  
deny ip  any 192.168.20.0 0.0.0.255 
permit ip any any

interface GigabitEthernet0/0/0.40
encapsulation dot1Q 40
ip access-group DMZ-Day4  IN