I want to block two VLANS from pinging eachother

[wfirth2012]

Hi so I have a layer 3 switch with two vlans on which are then connected to a firewall through a trunk port, i have a DHCP server setup on the firewall which works as it should however i dont want the two VLANS to be able to ping each other only their own gate way how would i do this? any help would be appreciated 

[Kasun Bandara]

@wfirth2012 i assume your gateway is at firewall for those VLANs. you can use ACL to block ICMP traffic between VLANs.

[wfirth2012]

THe ACL on the firewall is very basic from what i can see and will only let me block all pings, i will attach a photo for better reference 

[Kasun Bandara]

@wfirth2012 seems like you are using sohpos. in sophos you need to configure firewall policies to do that. 

https://www.youtube.com/watch?v=uqz-UOVIaA0&ab_channel=NoorNetworks

[Martin L]

This could be done with so called VLAN Maps directly on L3 switch.  VLAN Maps also control filtering within a VLAN (as far as I know the only way to do so).  VLAN maps have no direction, instead, To and From (source or destination) is controlled by Extended ACL inside VLAN map.  Then you will also need a match clause (a map) for IP, network, even MAC.  The action command specified what to do with match; default is to forward, but you could deny or redirect (on some high-end switches).

example:

ip access-list Extended NAME

permit icmp any any   <match what/who/to/from

vlan access-map MAP1  10

match ip address NAME

action drop  << what to do with it

vlan access-map MAP1  100  <<default action applies here

vlan filter MAP1  vlan-list 1,10,100   <<< apply to what vlan or vlans (here 1,10,100 only)

VLAN Maps are very tricky and confusing at first; it may take some practice to get used to.

Regards, ML
**Please Rate All Helpful Responses **