Help with an ACL

[Gregory Forster]

I have multiple subnets blocked out from 10.2.0.0/16 each subnet is a /24. I would like to block the 10.2.19.0/24 subnet from accessing all other subnets. How would I go about doing this, would I need to create an ACL with a line for each subnet, or could I just create an ACL that blocks all subnets?

[Jon Marshall]

Just deny 10.2.19.0/24 to 10.2.0.0/16 and then allow 10.2.19.0/24 to any other IP if they need to talk to other subnets or the internet for example.

Then apply the acl inbound on the L3 interface for the 10.2.19.0/24 subnet.

Jon

[Gregory Forster]

So my config would look like this?

access-list 19 deny 10.2.19.0/24 0.0.0.255 10.2.0.0 0.0.0.255

access-list 19 permit any

interface vlan 19

access-group 19 in

[Jon Marshall · Accepted solution]

You need to use an extended acl eg -

access-list 101 deny 10.2.19.0 0.0.0.255 10.2.0.0 0.0.255.255
access-list 101 permit 10.2.19.0 0.0.0.255 any

then apply to the interface as per your example.

Jon

[Gregory Forster]

Jon,

I was just doing that as you replied. Thank you so much for verifying this for me.

[Jon Marshall]

No problem, glad to help.

Jon

[Gregory Forster]

Jon,

Ok I tried that and I am still able to ping other subnets. Config is shown below

access-list 101 deny ip 10.2.19.0 0.0.0.255 10.2.0.0 0.0.255.255
access-list 101 permit ip 10.2.19.0 0.0.0.255 any

interface Vlan19
description Video-VLAN19
ip address 10.2.19.x 255.255.255.0
ip access-group 19 in

[Jon Marshall]

You are referencing the wrong acl ie. change this -

ip access-group 19 in

to

ip access-group 101

my fault, should have been clearer in my earlier response.

Jon

[Gregory Forster]

Jon,

I am so dumb. Thanks for pick that out for me.

[Jon Marshall]

Not dumb, easy mistake to make and I wasn't very clear in my previous answer.

Jon