Cisco Routing

[rathish4rock1]

Hi Friends, i need ur help, i m a beginer pls help me. i have 5 vlans in my L3 cisco switch and i enable i routing also. but i want to deny particular 2 vlans to deny the internet. 

[Georg Pauwen]

Hello,

it depends how your NAT is configured. You can either exclude the VLANs from being translated, or you can apply an access list on the VLAN iinterfaces that denies all traffic to public IP addresses.

[Deepak Kumar · Accepted solution]

Hi,

You have many options:

1. Don't allow on NAT ACL on your router to those two VLANs.

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

2. Configure Dany ACL on Router LAN interface with those two VLAN subnets.

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

3. Configure VLAN-ACL (VACL) on the switch to stop subnet to communicating with VLAN which is configured between the router and your switch.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/vlan_acls.html

Regards,

Deepak Kumar

[rathish4rock1]

Thanks for ur guiding. It's very helpful to me. I ll try this.