How to block Traffic between two host in same vlan

[Faisal Shabbir]

Hello

i want to block traffic b/w two hosts in same vlan, host are connected to 3750 stacked switches , i have heard that MAC acl works but i tried it its not working any suggestion ??

Regards,

Malik

[Jon Marshall]

Faisal

MAC acls only control non IPv4 traffic.

If you need to contol traffic between two hosts in the same vlan you can still use a VACL but you must use IP addresses and not mac addresses to control the traffic.

See this link for full details -

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swacl.html#wp1689492

Jon

[Faisal Shabbir]

Jon,

Thanks for your your doc is lenghty if you solve this issue hereit will be much better will save my time

source 10.10.60.133 destintion 10.10.60.150 (want to deny all traffic b/w them)

if possible tell me where should i configure it either on access layer sw0r core layer sw ??

[Jon Marshall]

Are both hosts connected to the same switch ?

If so you need do it on that switch.

Jon

[Faisal Shabbir]

i believe both are on same if not then ???

[Jon Marshall]

Faisal

Actually i don't think it matters to be honest.

Just apply it on the access switch (assuming at least one host is connected to the access switch).

If they are both connected directly to the L3 switch then apply it there.

Be careful when applying it ie. make sure after you have denied the specific traffic you then allow all other traffic.

Jon

[Faisal Shabbir]

with extended ACL rite ??? and dont need to place on any interface or port ??

[Jon Marshall · Accepted solution]

Yes, you would use an extended acl and it is not applied to any port.

You could use port acls for both hosts and apply them inbound on both host ports using an extended acl and it would achieve the same thing if you are uncomfortable with using a VACL within the vlan.

Jon

[raazans01]

Will this solution of applying VACLs to filter traffic between 2 hosts on the same VLAN (connected to same or different switches) work if the switch is a Nexus 7K switch running nx-os? It worked for me on ios but don't seem to be working on Nexus.

Please advise

[Georg Pauwen]

Hello,

VACLs should work on the N7K in the same way. How did you configure the VACL ? Make sure you comply with the restrictions outlined in the link below:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x_chapter_010000.h...

[raazans01]

Hi Georg,

Below is my config related to VACL:

*NX-OS*


*#Any specific traffic that needs to be allowed on the same VLAN, for
example default gateway, DHCP etc*

IP access-list acl-100 permit ip 172.24.51.1 0.0.0.0 172.24.51.0 0.0.0.255

IP access-list acl-100 permit ip 172.24.51.0 0.0.0.255 172.24.51.1 0.0.0.0



*#first deny only intra-VLAN icmp traffic*

Ip access-list acl-101 permit icmp 172.24.51.0 0.0.0.255 172.24.51.0
0.0.0.255 echo

Ip access-list asl-101 permit icmp 172.24.51.0 0.0.0.255 172.24.51.0
0.0.0.255 echo-reply


# then deny all intra-VLAN traffic

Ip access-list acl-101 permit ip 172.24.51.0 0.0.0.255 172.24.51.0 0.0.0.255

Ip access-list acl-101 permit udp 172.24.51.0 0.0.0.255 172.24.51.0
0.0.0.255


*# default permit*

Ip access-list acl-102 permit ip any any


*# vlan access-map vacl-microseg*

vlan access-map vacl-microseg 10

match ip address acl-100

action forward

vlan access-map vacl-microseg 20

match ip address acl-101

action drop

vlan access-map vacl-microseg 30

match ip address acl-102

action forward


*# Apply VACL to VLAN 351*

vlan filter vacl-microseg vlan-list 351

[Faisal Shabbir]

Thnx Jobfor your help