Guest Wireless acl for segmentation from internal devices

[malcolm sutton]

I am trying to segment my Guest Wireless from our internal network. I only want guess to be able to out to the internet and get DHCP and DNS internal. Here is the acl i created:

ip access-group Wireless-Guest in(here is the extended acl and the config on the vlan interface)

10 permit udp any host 10.50.0.161 eq bootps
11 permit udp any host 10.56.28.114 eq bootps
20 permit udp any host 10.56.28.111 eq domain
21 permit udp any host 10.56.28.112 eq domain
22 permit udp any host 10.56.28.113 eq domain
120 deny ip any 10.0.0.0 0.255.255.255 (605048 matches)
121 deny icmp any 10.0.0.0 0.255.255.255
130 deny ip any 192.168.0.0 0.0.255.255 (2 matches)
131 deny icmp any 192.168.0.0 0.0.255.255
140 deny ip any 172.16.0.0 0.15.255.255 (1 match)
150 permit ip any any (561 matches)
151 permit icmp any any

Is this right?

[Ruben Cocheno]

@malcolm sutton 

Yes, that is pretty much what you need to block all internal access except DNS and DHCP, and be able to reach the Internet.

[balaji.bandi]

High level that should be ok, but depends how your network diagram looks like, and where you appling this ACL.