ACL is not blocking traffic between VLANs

[ALIAOF_]

I am trying to block traffic from one VLAN to other VLAN's and even  after applying an ACL with "deny ip any any" traffic is still going  through.  Here is my config:

Note:  Both switches are setup in a GLBP configuration

Access List:

ip access-list extended VLAN120_IN

deny ip 10.1.120.0 0.0.0.255 any

Switch 1:

interface vlan 120

ip access-group VLAN120_IN in

Switch 2:

interface vlan 120

ip access-group VLAN120_IN in

Now  when I do a ping to my own laptop and source it from vlan 120 like  this, "ping 10.1.136.72 source vlan 120" I get successful replies.  Any  idea what am I missing here?  Thank you

Note:  I even tried VLAN ACL setup same results.  I can ping the host from one switch(the one that is AVF) but not the the other.

[Reza Sharifi]

If you are trying to block traffic from one vlan to another, try your access-group outbound and test again.

HTH

[ALIAOF_]

I'm trying to block traffic from VLAN120 to other VLAN's.  So I applied the access-group in as that is supposed to be the traffic from the hosts on the 120VLAN to other VLAN's or is that wrong?

[Shirshendu Nandi]

what is your Vlan 120 Ip adress range configured

[ALIAOF_]

VLAN 120 IP range is 10.1.120.0/24

[pille1234 · Accepted solution]

Hallo

Mohammad Ali schrieb:
Now  when I do a ping to my own laptop and source it from vlan 120 like  this, "ping 10.1.136.72 source vlan 120" I get successful replies.  Any  idea what am I missing here?  Thank you

That is expected behaviour. The ACL works only for traffic going through the switch, not for switch generated traffic. Try to ping the gateway from a host in vlan 120 and you will get a dest. unreachable message.

Pinging int vlan 120 from outside vlan 120 on the other hand will show you a successful answer.

Regards

[ALIAOF_]

Thank you that was it .