Inter VLAN Routing on ASA 5506

[Charger1129]

Hi. I have an ASA 5506 with 3 internal VLANs on it. I need to prevent the VLANs from talking to each other but, allow a few specific IP addresses through from the main VLAN to the other 2. 

Example:

VLAN 20

• nameif inside1
• IP address to allow to other VLANs - 10.10.100.10

VLAN 30

• nameif inside2
• traffic should be allowed to only speak to IP 10.10.100.10 from VLAN 20

VLAN 40

• nameif inside3
• traffic should be allowed to only speak to IP 10.10.100.10 from VLAN 20

I know this command will allow all traffic between VLANs, but I'm not sure if I should then create deny rules to only allow the 1 IP address through or if I need to remove this command and do it a different way. Any suggestions on the correct commands would be greatly appreciated. 

[Ganesh Hariharan]

Hi. I have an ASA 5506 with 3 internal VLANs on it. I need to prevent the VLANs from talking to each other but, allow a few specific IP addresses through from the main VLAN to the other 2. 

Example:

VLAN 20

• nameif inside1

• IP address to allow to other VLANs - 10.10.100.10

VLAN 30

• nameif inside2

• traffic should be allowed to only speak to IP 10.10.100.10 from VLAN 20

VLAN 40

• nameif inside3

• traffic should be allowed to only speak to IP 10.10.100.10 from VLAN 20

I know this command will allow all traffic between VLANs, but I'm not sure if I should then create deny rules to only allow the 1 IP address through or if I need to remove this command and do it a different way. Any suggestions on the correct commands would be greatly appreciated. 

Hi,

You can apply ACL on each interface in direction for the above said requirement. I hope all VLANS gateway are ASA interface.

Check out the below link for more information on how to apply ACL in ASA.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/access_nw.html

Hope it Helps..

-GI

Rate if it Helps..

[Charger1129]

Figured it out on my end. I was able to establish ACL's to do the necessary blocks, but also forgot to add the ACL to appropriate interface (nameif). Once that was applied all was working. 

[Richard Burts]

Thanks for posting back to the forum to tell us that you have figured out the solution to your own problem. Applying the ACL to the interface is one of those things that is easy to forget and this could be a good lesson for many of us.

HTH

Rick

[piyush.dhupia]

Hi Charger1129,

You can use Inbound ACL.

Hope it work

Regards,

Piyush