ASL and Sub Interfaces

[netracernz]

I am trying to secure sub interfaces on a 2600 Router

interface FA0/1.1

No Access-group

Interface FA0/1.2

IP Access-group 110 out

Access-list 110 deny ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255

Access-list 110 permit ip any any

This works but it blocks traffic both ways I only want to block one, I dont want FA0/1.2 to be able to access FA0/1.1 but I want all traffic to be allowed to go the other way

Any Suggestions would be great if you need more info on the network setup please ask

[Richard Burts]

Clinton

What you are attempting to accomplish is more difficult than it appears at first. The difficulty is that you are attempting to block requests from one VLAN to the other but the access list is also blocking responses going back. What you really want is something that can do statefull inspection and so could distinguish a request going over which you do not want to work from a response going back which you do want to work. That is difficult to accomplish with access lists. For TCP traffic you can use the established parameter for this but there is not an easy way to do it for UDP traffic.

HTH

Rick

Sent from Cisco Technical Support iPhone App

[netracernz]

Thanks Burt

I am a newbie to cisco, have you got any suggestion on where to get some basic Idea on what I need to do to accomplish what I want in the way of securing my Vlans