block users in Vlan from access internal company sites

[awabalhassan]

Hi guys!

I have a use-case where I’m using a L3 core switch (IP services)  and i have 5 Vlans their names are 10,20,30,40,50 

from Vlan 10-40 are for staff and number 50 is for guests with the range for Guests ( 172.16.160.x to 172.16.191.x).

and i have Wi-Fi devices for each Vlan. 

my question is how can i prevent every user that in Vlan 50 ( Guests ) from accessing internal company sites  and allowing them to use just internet (google, youtube etc..)

i know i should use ACL but how??

kind regards

[Martin L]

ACL is one way but I think most ppl will recommend using VLAN ACL -vlan access maps. 

Regards, ML
**Please Rate All Helpful Responses **

[awabalhassan]

thank you i'll read about it

[Joseph W. Doherty]

One possible method would be to have both in and out ACLs on your guest gateways (likely the SVI for VLAN 50) blocking IPs in your internal IP address range(s).

The forgoing answers the conceptional how but if the concept is unclear or you need help on actual config, let us know.

[awabalhassan]

yes i need the configuration, for example lets say i have this subnets

192.168.1.x/24 vlan 10

192.168.2.x/24 vlan 20

192.168.3.x/24 vlan 30

192.168.4.x/24 vlan 40

192.168.5.x/24 vlan 50

192.168.6.x/24 vlan 60

192.168.7.x/24 vlan 70

i want to prevent 192.168.7.x/24 vlan 70 users from accessing internal company sites and accessing other vlans, just the allowed to use internet 

[Joseph W. Doherty]

ip access-list extended BlockIn
 deny ip any 192.168.1.0 0.0.0.255
 deny ip any 192.168.2.0 0.0.0.255
 deny ip any 192.168.3.0 0.0.0.255
 deny ip any 192.168.4.0 0.0.0.255
 deny ip any 192.168.5.0 0.0.0.255
 deny ip any 192.168.6.0 0.0.0.255
 permit ip any any

ip access-list extended BlockOut
 deny ip 192.168.1.0 0.0.0.255 any
 deny ip 192.168.2.0 0.0.0.255 any
 deny ip 192.168.3.0 0.0.0.255 any
 deny ip 192.168.4.0 0.0.0.255 any
 deny ip 192.168.5.0 0.0.0.255 any
 deny ip 192.168.6.0 0.0.0.255 any
 permit ip any any

interface Vlan70
 ip access-group BlockIn in
 ip access-group BlockOut out