ACL to prevent InterVLAN Routing and enable access to Internet

[Ranjita]

Hi All,

I have multiple VLANs and OSPF running on a L3 Switch. I want to prevent VLAN's 1,2 and 3 communicating with each other but each of the VLAN's should reach an external network via OSPF.

I tried configuring an ACL to prevent inter-VLAN routing but in that case my connection to the external network is also lost.

ip access-list extended AAA

deny ip any <SVI of VLAN B>

permit ip any any

exi

int vlan A

ip access-group AAA in

exi

I have tried to block just one VLAN for now but not successful.

Could anyone please help me with it?

[Joseph W. Doherty]

---

@Joseph W. Doherty wrote:

---

@MHM Cisco World wrote:

Acl apply to SVI can  not filter traffic toward SVI İp but it can filter traffic bypass SVI. 

---

Oh?  Hmm, I didn't know that.  I'll set up a lab to confirm that.

---

(PT) Lab results:

I was able, on a SVI (in PT) block ingress echo requests, while allowing echo request to transit the interface.  So, it appears you CAN filter traffic to the SVI IP, itself.

switch#sh cdp n
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
Switch Gig 1/0/1 144 3650 Gig 1/0/1

Relevant L3 switch config snippets:

Switch0:

ip routing

interface Loopback0
ip address 192.168.2.1 255.255.255.255

interface GigabitEthernet1/0/1

interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip access-group test in

ip access-list extended test
deny icmp any host 192.168.1.1 echo
permit ip any any

Switch1:

ip routing

interface GigabitEthernet1/0/1
no switchport
ip address 192.168.1.2 255.255.255.0

ip route 0.0.0.0 0.0.0.0 192.168.1.1

Pinging Switch0's SVI IP from Switch1:

Switch#ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
UUUUU
Success rate is 0 percent (0/5)

Pinging Switch0's Loopback0 IP from Switch1:

Switch#ping 192.168.2.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/0 ms