Hi Stijn,
interface Vlan500
ip address 10.5.0.1 255.255.240.0
!
interface Vlan516
ip address 10.5.16.1 255.255.240.0
To allow traffic from demo to education (and returning traffic) but deny traffic originating from education to demo
we carete an Access-list and add the established keyword at the end of the permit statement. This would allow only traffic orignated from demo back and forth but deny any other traffic, but this would work for TCP protocol only. It indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bit set. The nonmatching case is that of the initial TCP datagram to form a connection.
ip access-list ext 123
permit tcp any any established
we apply this in the inbound direction on the Education Vlan. So all traffic from demo would come to education , but return traffic only with ACK or RST bit set is allowed. So no new connections from Education would be allowed.
------------------------------------------
For the Second question:-
With respect to the access-list it would matter how we are defining the ACL to the flow of traffic.
An ACL may be applied in either direction as long as we define the traffic and its flow correctly.
for eg:-
if we want a certain host x.x.x.x from education vlan 516 to be blocked from being reached by a host y.y.y.y on demo vlan 500, then we can have the acl in two ways, applied on that Vlan 500 interface
x.x.x.x-- 516---switch---500---y.y.y.y
ip access-list ext 123
deny ip host y.y.y.y host x.x.x.x
this would have to be applied in the inbound direction as the traffic hitting vlan 500 would have source ip of y.y.y.y and dest ip of x.x.x.x
if we were to configure it this way
ip access-list ext 123
deny ip host x.x.x.x host y.y.y.y
then it would have to be applied in the out bound direction as it would be leaving the router with a source ip of x.x.x.x to reach y.y.y.y on vlan 500
hope this helps
Gayathri
Please rate if this answered your question
