access lists

[carl_townshend]

If I have an ethernet interface with a primary and secondary ip on it, Can I put an access list on this prevent certain ip's from one subnet seeing the other, and would I have to apply this both ways ?

[vladrac-ccna]

Hello Carl,

I'll respond if you promisse to rate the post!

Just kidding,

ok , you can do and yes, both ways.

interface FastEthernet0/1

ip address 10.10.2.1 255.255.255.0 secondary

ip address 10.10.1.1 255.255.255.0

ip access-group 100 in

ip access-group 100 out

access-list 100 deny ip 10.10.1.0 0.0.0.255 10.10.2.0 0.0.0.255

access-list 100 permit ip any any

that will do

HTH,

please rate this post if it does.

Vlad

[carl_townshend]

Thankyou, how come you have to apply it both ways ?

[vladrac-ccna]

As a matter of fact you dont!

just choose put it in

ip access-group 100 in

Thank you for bringing it to my attention.

Vlad