allow an IP in VACL

[night-fury]

Hi,

I have a VACL configured as below:

access-list 100 permit ip 172.16.1.0 0.0.0.127 host 172.16.0.52

vlan access-map ABC 10
 match ip address 100
 action drop
vlan access-map ABC 20
 action forward

vlan filter cls vlan-list 1

Now this VACL blocks ips 172.16.1.0 - 172.16.1.127. I want to allow one of the IPs say 172.16.1.16 - this IP should be able to connect to 172.16.0.52

Can this be achieved? i am unable to figure out a way.

[Francesco Molino · Accepted solution]

Hi,

You need to modify your acl to deny the host you want to allow:

access-list 100 deny ip host 172.16.1.16 host 172.16.0.52
access-list 100 permit ip 172.16.1.0 0.0.0.127 host 172.16.0.52

[night-fury]

thank you. this worked seamlessly with my already existing ACL !!

[Francesco Molino]

You're welcome!

[paul driver]

Hello

Try:

access-list 101 permit host 172.16.1.16 host 172.16.0.52
vlan access-map ABC 5
match ip address 101
action forward