cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
395
Views
0
Helpful
1
Replies
Beginner

Inter-Vlan Routing Acls

Hello,

I have my Cisco 2800 Configured with Sub-intefaces, and I would like do do inter-vlan router but only in certian conditions.

SubIntefaces

0/0.1 Vlan 10 Staff (IP 10.10.100.1 255.255.255.0)

0/0.2 Vlan 20 Voice (IP 10.20.100.1 255.255.255.0)

0/0.3 Vlan 30 Public (IP 10.30.100.1 255.255.255.0)

0/0.3 Vlan 40 DMZ  (IP 10.40.100.1 255.255.255.0)

Staff Should be able to acess the following vlans:

Voice

Public

DMZ

No vlans should be able to access staff. No other vlans should be able to acess another one.

I believe I would use the Establish option. But I can't seem to get it working. Can you give me a sample config of what I need to enter?

1 REPLY 1
Beginner

Inter-Vlan Routing Acls

I would say it could be extremely easy to accomplished if you replace your 2800 router with a Cisco ASA firewall. But that was not what you asking. AFAIK, established option in cisco router ios could only apply to tcp connections so udp and icmp are still permitted even your configuration works.

to verify if established option works you could try to deny your telnet/ssh/remote desktop into your cisco device or windows server/pc in another subnet:

ip access-list extended TEST_EST

deny tcp host YOUR_CISCO_DEVICE host YOUR_PC eq 23 established

#deny TCP establishment between test device and your pc. change 23 to different port numbers if you want to try with other protocol. 80 for web, 3389 for remote desktop

permit ip any any

permit icmp any any

#this two lines are used so that end user will not be disconnected from network

then apply this access-list to the subinterface where target device locates

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards


This widget could not be displayed.