How to setup an ACL between these two hosts?

[bendetamasmark1]

Ok, i have a bit problem i don't know how to solve:

I have got a router, to it a switch is connected, and to it there are two servers connected.

The router is connected to the switch on the fa0/1 interface (192.168.2.249).

The two hosts are connected to the switch on the fa0/1 and fa0/2 switch interface.

I want to make sure that the two hosts are unable to ping each other.

Host 1 ip address is: 192.168.2.250

Host 2: 192.168.2.251

Can someone help me how to setup the ACLs so they cant reach each other? I know the wildcard mask should be 0.0.0.0, but i'M not sure what the acl command should look like.

On which interface should this ACL be applied? In, out?

Thank you for your help in advance.

[Philip D'Ath · Accepted solution]

What sort of switch do you have?

A private vlan edge/protected port may be easer.

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_010010.html#concept_4357B1B049A147C5A904F4E53B3AEF50

[bendetamasmark1]

A 2950T-24.

So if I set the switches fa0/1 and fa0/2 to be protected ports, they cannot ping each other, but they can still be reached from other ports?

[Richard Burts · Accepted solution]

Since both host addresses are in the same subnet these hosts would communicate directly and would not go through the router. So there is not any kind of access list on the router that could prevent the hosts communicating. Perhaps there might be some kind of port ACL on the switch. But protected ports is probably the best alternative.

HTH

Rick

[Richard Burts]

I am glad that our suggestions have been helpful to you. Thank you for using the rating system to mark this question as answered. This will help other readers in the forum to identify discussions which have useful information.

I hope you will continue to be active in these forums.

HTH

Rick

[Philip D'Ath]

2950's support protected ports.  Follow that URL I gave and you can configure it up.

[Philip D'Ath]

Yes, they can be reached from other ports.