VLAN restriction

subashmbi · ‎02-20-2006

How to restrict the intervlan.rigtnow we are all the vlan have to access.so pls give some idea for the same.

ankurbhasin · ‎02-20-2006

Hi Subash,

One way to restrict is to apply ACL and apply it on the interfaces.

Can you please update how have you configured the inter vlan routing? On layer 3 switch or router on stick model.

If you are using layer 3 switch like 3550 switch you can configure acls so check this link

If you are using inter vlan routing on cat6k switch you can also use VACL to restrict traffic so check this link out

HTH, if yes please rate the post.

Ankur

nethelper · ‎02-20-2006

Hello,

in addition to Ankur's post, a simple way to restrict access between VLAN's would be configuring access lists as in the sample configuration below:

interface FastEthernet0/0.1

encapsulation dot1q 1 native

ip address 192.168.1.1 255.255.255.0

ip access-group 100 out

!

interface FastEthernet0/0.2

encapsulation dot1q 2

ip address 192.168.2.1 255.255.255.0

ip access-group 101 out

!

access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

access-list 100 permit ip any any

!

access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

access-list 101 permit ip any any

For SVI's (VLAN interfaces) the configuration would look like this:

interface Vlan1