Good morning, I have a Cisco SG300-10 10Port Gigabit Managed Switch that is set to L3 Mode. I have set 2 vlan (vlan 30 and vlan 40) and set a static route from our firewall so the vlan can connect to the internet. Now as I go further, I would like to make vlan 30 inaccessible by vlan 40 while vlan 40 can be access by vlan 30 and at the same time both vlan would have an internet connectivity. As I searched for this, I came across with ACL, and tried to configure the switch. However, during the process, what happened was, both vlan can no longer access with each other but there is still an internet connectivity for each vlan.
For my current switch running-config, please do see the information below.
config-file-header
Switch
v1.3.5.58 / R750_NIK_1_35_647_358
CLI v1.0
set system mode router
file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
!
vlan database
vlan 30,40
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
ip dhcp relay address 192.168.20.254
ip dhcp relay enable
ip dhcp information option
bonjour interface range vlan 1
ip access-list extended Dot30
permit ip 192.168.30.0 0.0.0.255 192.168.20.113 0.0.0.255
deny ip 192.168.30.0 0.0.0.255 192.168.40.0 0.0.0.255
exit
ip access-list extended Dot40
permit ip 192.168.40.0 0.0.0.255 192.168.20.113 0.0.0.255
permit ip 192.168.40.0 0.0.0.255 192.168.30.0 0.0.0.255
exit
hostname switch
clock timezone " " 0 minutes 0
clock dhcp timezone
!
interface vlan 1
shutdown
!
interface vlan 30
ip address 192.168.30.1 255.255.255.0
ip dhcp relay enable
!
interface vlan 40
ip address 192.168.40.1 255.255.255.0
ip dhcp relay enable
!
interface gigabitethernet1
service-acl input Dot30 default-action permit-any
switchport mode access
switchport access vlan 30
switchport forbidden default-vlan
!
interface gigabitethernet2
service-acl input Dot30 default-action permit-any
switchport mode access
switchport access vlan 30
switchport forbidden default-vlan
!
interface gigabitethernet3
service-acl input Dot30 default-action permit-any
switchport mode access
switchport access vlan 30
switchport forbidden default-vlan
!
interface gigabitethernet4
service-acl input Dot30 default-action permit-any
switchport mode access
switchport access vlan 30
switchport forbidden default-vlan
!
interface gigabitethernet5
service-acl input Dot40 default-action permit-any
switchport mode access
switchport access vlan 40
switchport forbidden default-vlan
!
interface gigabitethernet6
service-acl input Dot40 default-action permit-any
switchport mode access
switchport access vlan 40
switchport forbidden default-vlan
!
interface gigabitethernet7
service-acl input Dot40 default-action permit-any
switchport mode access
switchport access vlan 40
switchport forbidden default-vlan
!
interface gigabitethernet8
service-acl input Dot40 default-action permit-any
switchport mode access
switchport access vlan 40
switchport forbidden default-vlan
!
interface gigabitethernet9
switchport forbidden default-vlan
!
interface gigabitethernet10
ip address 192.168.20.113 255.255.255.0
switchport forbidden default-vlan
!
exit
ip default-gateway 192.168.20.254
Please do note that the ACL configuration was done using the web GUI for I keep on having error like unrecognized command if I'd go for CLI command. Hoping for any help from you guys. Thank you very much in advance.
