ACL to block Internet Access from specific vlan

[sreeraj.murali]

Hi,

Please help with Access list on the Internet Router restricting Internet access from specific vlan to specific destination and allowing complete Internet access from another vlan.

I am attaching the topology pic, with all the details, please provide expert assistance.

Thanks & Regards

Sreeraj

[Meheretab Mengistu · Accepted solution]

Hi,

You need to use extended ACL as you want to select based on both source and destination addresses. You can try the following (on the router):-

access-list 100 permit ip 172.20.4.0 0.0.1.255 any
access-list 100 permit ip 172.20.2.0 0.0.0.255 host 185.61.213.80
access-list 100 permit ip 172.20.2.0 0.0.0.255 host 170.12.17.15
access-list 100 permit ip 172.20.2.0 0.0.0.255 host 170.12.141.9
! You do not need the deny statement because there is implicit deny at the end of ACLs.

interface gi0/0
ip access-group 100 in
end

HTH,
Meheretab

[Julio E. Moisa]

Hi

Additional if you have any GRE tunnel passing through there, you can add

access-list 100 permit gre any any

And if you are using any ipsec over GRE for VPNs you can add the UDP ports 4500 and 500

[sreeraj.murali]

Thanks, Sure will add.

[sreeraj.murali]

Thanks!!! I will try it out.

[Julio E. Moisa]

Great, please keep us posted and please don't forget to rate the comments if they were useful

Have a great day

:-)

[sreeraj.murali]

Wil do that for sure.

[Julio E. Moisa]

Thank you :-)