Restrict Inter-VLAN routing

[dan_miles86]

Sorry if this is a silly question but I've read so many ariticles and gone in so many circles I'm not totally confused!

I have 3 VLAN's  (native, 40 & 50) covering across a bunch of switches being trunked back to a Cisco 2851. VLAN's 40 and 50 are configured as sub-interfaces and defined as IP Nat Inside. I then have an external internet connection which is IP NAT Outside.

All is working great however, I need to restrict routing between these internal VLAN's/subnets while stilling allowing access to the outside NAT connection.

Can anyone give me a pointer on how to do this as for security reasons I don't want these devices to be able to talk to each other.

Thanks

[Seb Rupik · Accepted solution]

Hi there,

The traffic betweem VLANs 40 and 50 will not be NAT'd so we don't need to worry about that.

I have made the following subnet assumptions:

VLAN40 : 10.0.40.0 /24

VLAN50: 10.0.50.0 /24

...and your bunch of switches are connected to fa0/1 , the following config should have the desired effect:

!
ip access-list ext v40-to-v50
  10 deny ip 10.0.40.0 0.0.0.255 10.0.50.0 0.0.0.255
  20 permit ip any any
!
ip access-list ext v50-to-v40
  10 deny ip 10.0.50.0 0.0.0.255 10.0.40.0 0.0.0.255
  20 permit ip any any
!
!
int fa0/1.40
  ip access-group v40-to-v50 in
int fa0/1.50
  ip access-group v50-to-v40 in
!

cheers,

Seb.

[dan_miles86]

Thank you Seb.

I was very close but so far away! The following got it working.

ip access-list ext native
10 deny ip 192.168.30.0 0.0.0.255 192.168.31.0 0.0.0.255
11 deny ip 192.168.30.0 0.0.0.255 192.168.32.0 0.0.0.255
20 permit ip any any

ip access-list ext visitor
10 deny ip 192.168.31.0 0.0.0.255 192.168.30.0 0.0.0.255
11 deny ip 192.168.31.0 0.0.0.255 192.168.32.0 0.0.0.255
20 permit ip any any

ip access-list ext guest
10 deny ip 192.168.32.0 0.0.0.255 192.168.30.0 0.0.0.255
11 deny ip 192.168.32.0 0.0.0.255 192.168.31.0 0.0.0.255
20 permit ip any any

!native
int g1/0
ip access-group native in

!visitor
int g1/0.1
ip access-group visitor in

!guest
int g1/0.2
ip access-group guest in