Here is the complete access

jahanzeb.feroze · ‎03-17-2015

I have Inter Vlan Routing done on my Core Switch, through which subnets are restricted to access each other, Example subnet of 10.1.23.0 cannot have access to subnet of 10.1.24.0.

Due to certain requirement i want that 10.1.23.19(Users Worskstain IP) can access 10.1.24.41 (Users Workstation IP)

Is it possible to do that, without disturbing my InterVlan Routing? Please suggest

SANTHOSHKUMAR SARAVANAN · ‎03-17-2015

Hi ,

Share me your show running configuration from your device . Let me help you in building the ACL

HTH

Sandy

jahanzeb.feroze · ‎03-18-2015

Below is the Configuration of Intervlan Routign on my core Switch, please suggest

interface Vlan2
description IAS
ip address 10.1.14.2 255.255.254.0
ip access-group IAS out
vrrp 2 ip 10.1.14.5
vrrp 2 priority 99
!
interface Vlan3
description MKT
no ip address
ip access-group MKT out
vrrp 3 ip 10.1.6.5
vrrp 3 priority 99
!
interface Vlan4
description ESG
ip address 10.1.16.2 255.255.255.128
ip access-group ESS out
vrrp 4 ip 10.1.16.5
vrrp 4 priority 99
!
interface Vlan5
description NMSG
ip address 10.1.24.2 255.255.255.128
vrrp 5 ip 10.1.24.5
vrrp 5 priority 99
!
interface Vlan6
description OAG
ip address 10.1.26.2 255.255.255.128
vrrp 6 ip 10.1.26.5
vrrp 6 priority 99

interface Vlan7
description SMG
ip address 10.1.28.2 255.255.255.128
ip access-group SMG out
vrrp 7 ip 10.1.28.5
vrrp 7 priority 99
!
interface Vlan8
description DMG
ip address 10.1.30.2 255.255.255.128
ip access-group DMG out
vrrp 8 ip 10.1.30.5
vrrp 8 priority 99
!
interface Vlan9
description DMS_UAT
ip address 10.1.32.2 255.255.255.128
ip access-group DMS_UAT out
vrrp 9 ip 10.1.32.5
vrrp 9 priority 99
!
interface Vlan10
description SEG
ip address 10.1.34.2 255.255.254.0
vrrp 10 ip 10.1.34.5
vrrp 10 priority 99
!
interface Vlan11
description SEG-2
ip address 10.1.33.2 255.255.255.128
vrrp 11 ip 10.1.33.5
vrrp 11 priority 99
!
interface Vlan12
description Finance_F2
ip address 10.1.2.2 255.255.255.0
vrrp 12 ip 10.1.2.5
vrrp 12 priority 99
!
interface Vlan13
description Operations
ip address 10.1.10.2 255.255.255.128
ip access-group OPS out
vrrp 13 ip 10.1.10.5
vrrp 13 priority 99

interface Vlan17
description PD&T
ip address 10.1.36.2 255.255.255.128
ip access-group PDT out
vrrp 17 ip 10.1.36.5
vrrp 17 priority 99
!
interface Vlan18
description HR&Admin
ip address 10.1.8.2 255.255.255.0
ip access-group HR&Admin out
vrrp 18 ip 10.1.8.5
vrrp 18 priority 99
!
interface Vlan19
no ip address
!
interface Vlan20
no ip address
!
interface Vlan21
no ip address
!
interface Vlan22
description SEG3
ip address 10.1.44.2 255.255.255.128
ip access-group SEG3 out
vrrp 22 ip 10.1.44.5
vrrp 22 priority 99
!
interface Vlan23
description Call_Center
ip address 10.1.42.2 255.255.255.0
ip access-group CC out
vrrp 23 ip 10.1.42.5
vrrp 23 priority 99
!
interface Vlan24
description IT_Sec
ip address 10.1.23.2 255.255.255.0
vrrp 23 ip 10.1.23.5
vrrp 23 priority 99
!
interface Vlan25
description Q-mgmt
ip address 10.1.9.2 255.255.255.0
ip access-group ACESSCONTROL out
vrrp 25 ip 10.1.9.5
vrrp 25 priority 99
!
interface Vlan26
description RTA
ip address 10.1.150.2 255.255.254.0
ip access-group RTA out
vrrp 26 ip 10.1.150.5
vrrp 26 priority 99
!
interface Vlan27
description P&D
ip address 10.1.45.2 255.255.255.0
ip access-group PD out
vrrp 27 ip 10.1.45.5
vrrp 27 priority 99
!
interface Vlan28
description Trustee
ip address 10.1.18.2 255.255.255.0
ip access-group TRUSTEE out
vrrp 28 ip 10.1.18.5
vrrp 28 priority 99

ip access-list standard CC
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard CEO
deny   10.1.2.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard CS
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255

ip access-list standard DMG
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard DMSSCAN
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard DMS_UAT
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any

ip access-list standard ESS
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard FIN
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard HRADMIN
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard IAD
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard IAS
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard ITSEC
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255

ip access-list standard MKT
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard NMSG
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard OAG
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255

ip access-list standard OPS
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard PD
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard PDT
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard Q-mgmt
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
permit any

ip access-list standard RTA
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
permit any
ip access-list standard SEG
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard SEG2
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard SEG3
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard SMG
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard TRUSTEE
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.23.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any
ip access-list standard static-routes
permit 10.1.136.0 0.0.1.255
permit 10.1.138.0 0.0.1.255
permit 10.1.142.0 0.0.0.255
permit 10.1.144.0 0.0.1.255
permit 10.1.160.0 0.0.1.255
permit 10.1.200.0 0.0.1.255
permit 10.1.204.0 0.0.1.255
permit 10.1.210.0 0.0.0.255
permit 10.1.222.0 0.0.1.255
permit 172.18.100.0 0.0.0.255
permit 172.18.101.0 0.0.0.255
permit 172.18.102.0 0.0.0.255
permit 172.18.103.0 0.0.0.255
permit 172.18.104.0 0.0.0.255
permit 172.18.105.0 0.0.0.255
permit 172.18.106.0 0.0.0.255
permit 10.1.146.0 0.0.0.255
permit 192.168.1.0 0.0.0.255
permit 10.1.145.0 0.0.0.255

SANTHOSHKUMAR SARAVANAN · ‎03-18-2015

Dear feroze,

You dont have any access-group/acl group on below SVI interface , there shouldnt be any restriction between these VLAN . Entire IP to IP access should be available between this VLAN. Check and let me know .

interface Vlan24
description IT_Sec
ip address 10.1.23.2 255.255.255.0
vrrp 23 ip 10.1.23.5
vrrp 23 priority 99

interface Vlan5
description NMSG
ip address 10.1.24.2 255.255.255.128
vrrp 5 ip 10.1.24.5
vrrp 5 priority 99
!

HTH

Sandy

jahanzeb.feroze · ‎03-18-2015

Hello Sandy,

It was removed for a time being, actually it should be like

interface Vlan24
description IT_Sec
ip address 10.1.23.2 255.255.255.0

ip access-group ITSEC out
vrrp 23 ip 10.1.23.5
vrrp 23 priority 99

interface Vlan5
description NMSG
ip address 10.1.24.2 255.255.255.128

ip access-group NMSG out
vrrp 5 ip 10.1.24.5
vrrp 5 priority 99
!

This configuration blocking whole subnet i-e of 10.1.23.0 and 10.1.24.0, so is there any way that i can give access only from IP 10.1.23.19 to 10.1.24.41, rest should remain blocked.

Please suggest

Pino11122 · ‎03-24-2015

Yes, just permit the traffic on both of the ACLs between the VLANs by inserting it using a sequence number.

example (assuming you have an increment of 10):

ip access-list standard TEST

11 permit ip host x.x.x.x

You can re-sequence the ACL after if you with without disrupting traffic.

jahanzeb.feroze · ‎03-25-2015

Thanks a lot Pino,

Can you please write in the exact configuration or give some details?

Will be very very thankful

Pino11122 · ‎03-26-2015

Now that I look closer at the configuration you are using standard ACLs and filtering outbound. Standard ACLs will filter based on the source IP address and not the destination IP. So it appears that your ACLs only allow the Network assigned to the VLAN to exit, which would explain why when you apply the NMSG it doesn't work. The NMSG ACL does not have a permit statement so it will deny anything trying to leave that VLAN interface. You should think about changint the ACL to filter in rather than out, or just add the permit any statement at the end of the NMSG ACL and it will work.

jahanzeb.feroze · ‎03-30-2015

Dear Pino

Permit any will allow all the IPs, i want to allow just specific IP, as mention above. Please help

SANTHOSHKUMAR SARAVANAN · ‎03-31-2015

Dear Feroze ,

Can I have completed access-list of ITSEC , if possible share me webex link for online support .

ip access-group ITSEC out
deny 10.1.2.0 0.0.0.255
deny 10.1.4.0 0.0.0.255
deny 10.1.6.0 0.0.0.255
deny 10.1.8.0 0.0.0.255
deny 10.1.9.0 0.0.0.255
deny 10.1.10.0 0.0.0.255
deny 10.1.12.0 0.0.0.255
deny 10.1.14.0 0.0.0.255
deny 10.1.18.0 0.0.0.255

HTH

Sandy

jahanzeb.feroze · ‎04-01-2015

Here is the complete access-list of ITSEC

ip access-list standard ITSEC
deny   10.1.2.0 0.0.0.255
deny   10.1.4.0 0.0.0.255
deny   10.1.6.0 0.0.0.255
deny   10.1.8.0 0.0.0.255
deny   10.1.9.0 0.0.0.255
deny   10.1.10.0 0.0.0.255
deny   10.1.12.0 0.0.0.255
deny   10.1.14.0 0.0.0.255
deny   10.1.18.0 0.0.0.255
deny   10.1.24.0 0.0.0.255
deny   10.1.26.0 0.0.0.255
deny   10.1.28.0 0.0.0.255
deny   10.1.30.0 0.0.0.255
deny   10.1.32.0 0.0.0.255
deny   10.1.33.0 0.0.0.255
deny   10.1.34.0 0.0.0.255
deny   10.1.35.0 0.0.0.255
deny   10.1.36.0 0.0.0.255
deny   10.1.38.0 0.0.0.255
deny   10.1.42.0 0.0.0.255
deny   10.1.44.0 0.0.0.255
deny   10.1.45.0 0.0.0.255
deny   10.1.48.0 0.0.0.255
deny   10.1.50.0 0.0.0.255
deny   10.1.150.0 0.0.0.255
permit any

Webex is session is not possible for some days

jahanzeb.feroze · ‎04-06-2015

Hi sandy,

Please guide

jahanzeb.feroze · ‎03-20-2015

Dear Sandy

Waiting for your response.

agkhan-au · ‎03-19-2015

AOA,

What I understand that you have multiple VLans. and two computers from different Vlan need to access each other without Router.

If it is your requirement so yes you can do it. please tell me what O/S you have on both side?

thanks

Abuzar

jahanzeb.feroze · ‎03-20-2015

As already mention both O/S are PCs

Access provisioning through Access List