separating/isolating a vlan

[roncro]

Hello, 

if I want to separate/segregate one vlan (vlan10) from everything else, I think I can use an access-list like:

access-list 110 permit ip 192.168.10.0 0.0.0.255 192.168.1.1 0.0.0.0  correct?

The idea is that any ip in the 192.168.10.0 network is allowed, and the only other host is the router (192.168.1.1) or is there a better way  to do this on a Cisco 2951? (I put 192.168.1.1 in that list because I do not want to break connection to the internet/wan for machines in vlan10)

Ron

[paul driver]

Hello

Example:
ip access-list extended novlans 
deny ip any 10.10.5.0 0.0.0.255 < vlan 5>
deny ip any 10.10.6.0 0.0.0.255 < vlan 6>
etc..
permit ip any any

Int vlan 10
ip access-group novlans IN

[roncro]

Hello Paul,

so I have to mention every other vlan?  or could I do something like:

ip access-list extended noothervlans

permit ip any 10.10.10.0 0.0.0.255 <vlan 10>


deny ip any 10.10.0.0 0.0.255.255 <all 'other' vlans>


permit ip any any




Int vlan 10

ip access-group noothervlans IN

I wonder if access-list work in a "linux pam" way, or iptables,  applying the first rule, top down, that applies. (in this case you'd hit "if you're in 10.10.10.0 you're good to go"  if not, next rule,  "anything else in private space can't go there".

The example you gave undoubtedly works,  but whenever I create a new vlan, I have to not forget adding it to the vlan 10 access-list, that's why I'd like/prefer a "access only for this subnet/vlan" rule instead of  denying everything else.

Can that be done?

thanks,

Ron

[paul driver · Accepted solution]

Hello Ron
Yes that looks like it should do it.

FYI - the acl logic applied to an SVI on a switch.
IN = traffic originating from withIN vlan
OUT=  traffic originating from OUT the vlan