cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
537
Views
1
Helpful
8
Replies

ACLs

RaymondBui97693
Beginner
Beginner

I am trying to lock down some VLANs on a Cisco Cataylst 3850 with IOS XE 16.12.9 Gibraltar

I need vlan 101 to talk to 102 and 103 and get out to the internet

I need 103 to only talk to 101 and 102 with no internet

I tried to apply this ACL to 103 but can still ping everything

ip access-list extended 103
permit ip any 192.168.101.0 0.0.0.255
permit ip any 192.168.102.0 0.0.0.255
deny ip any any

interface vlan 103
ip access group 103 in
8 Replies 8

ip access-list extended 103
permit ip any 192.168.101.0 0.0.0.255
permit ip any 192.168.102.0 0.0.0.255
deny ip any any

interface vlan 103
ip access group 103 OUT 

M02@rt37
VIP
VIP

hello @RaymondBui97693,

ip access-list extended 101
permit ip any any

ip access-list extended 103
permit ip 192.168.101.0 0.0.0.255 any
permit ip 192.168.102.0 0.0.0.255 any
deny ip any any

interface Vlan101
ip access-group 101 in

interface Vlan103
ip access-group 103 in

 

With this configuration, VLAN 101 has unrestricted access to communicate with VLANs 102 and 103, as well as access to the internet. On the other hand, VLAN 103 is limited to communication with VLANs 101 and 102 but does not have internet access.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Jon Marshall
Hall of Fame
Hall of Fame

There is nothing wrong with your configuration ie. it should work because the acl is correct and is applied in the correct direction. 

Is there any other path the clients could take to get to the internet,  are you running HSRP etc. ? 

Jon

Jon:

All our sites are connected via SD-WAN. 

johnlloyd_13
Engager
Engager

hi,

you can try using private VLAN config.

RaymondBui97693
Beginner
Beginner

Is there a way to block ping to all the vlans. We want to confirm that there is no communication via ping. 

meaning between all VLAN ? 
if yes 
vlan x
ip add x.x.x.x 
ip access-group icmp IN

ip access-list icmp

deny icmp x.x.x.x any 
permit ip any any 

that it 

If you want to block ping  from 192.168.103.x to 192.168.101.x and 192.168.102.x add these lines at the top of your 103 acl - 

deny icmp any 192.168.101.x echo 
deny icmp any 192.168.102.x echo

as I said previously your configuration is correct so something else is happening here.

Jon

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: