Block trafic between VLAN on the same interface

[Sylvain Brault]

Hello everyone,

I have 3 VLANs on the same interface and would like to block all the trafic between the VLAN 3 (Wifi access) and the two others ones VLAN 1 & 2 for security reason.

As the routing is automatic between the VLANS on the same interface, how can I block the trafic? Do I need to use access-list ?

Thanks for your help!

Here is an extract of my configuration :

interface GigabitEthernet0/0

description Fiber Swisscomm

no ip address

duplex auto

speed auto

pppoe enable group global

pppoe-client dial-pool-number 1

no mop enabled

!

interface GigabitEthernet0/1

description LAN-Greenwich

no ip address

duplex auto

speed auto

no mop enabled

!

interface GigabitEthernet0/1.1

description LAN Greenwich

encapsulation dot1Q 1 native

ip address 192.168.0.254 255.255.255.0

ip nat inside

ip virtual-reassembly in

ip tcp adjust-mss 1452

!

interface GigabitEthernet0/1.2

description IPC

encapsulation dot1Q 2

ip address 192.168.1.254 255.255.255.0

!

interface GigabitEthernet0/1.3

description Wifi Greenwich

encapsulation dot1Q 3

ip address 192.168.2.254 255.255.255.0

ip nat inside

ip virtual-reassembly in

ip tcp adjust-mss 1452

[stephen.stack · Accepted solution]

Hi,

Yes, you would need an access list. something like this

ip access-list extended RESTRICT_WIFI

deny ip any 192.168.0.0 0.0.0.255

deny ip any 192.168.1.0 0.0.0.255

permit ip any any

!

interface GigabitEthernet0/1.3

ip access-group RESTRICT_WIFI in

!

==========================
http://www.rConfig.com 

A free, open source network device configuration management tool, customizable to your needs!

- Always vote on an answer if you found it helpful

[Sylvain Brault]

Thanks for your reply!