Limit the access on L2 level.

[ehsan]

It is a packet tracer lab in which i have a building having Basement ,ground floor 1st floor and 2nd floor.

i have 5 vlans in this lab. i configured all trunks between switches and applied inter vlan routing using L3 switch. all is going well all connectivity is working good. now i want to add access limitations that only from basement where the IT department is working and all PCs are in vlan 10 only this vlan which is vlan 10 can access all others upper floors vlans but from upper vlans no one can ping each other nor in Basement PCs that are in vlan 10. I cant understand how to do this. Please give me any idea how to do this...? Thanks in advance....

[Julio E. Moisa · Accepted solution]

Hi

In real enviroments you could configure: ACLs, VACL and using Firewalls. Now PT has some limitations so I think you could use ACLs only under the SVI of each VLAN on the Layer 3 device.  You could try for example:

For VLAN50

access-list IN-VLAN50 permit icmp 192.168.1.128 0.0.0.31 192.168.1.0 0.0.0.31 

access-list IN-VLAN50 deny icmp any any

access-list IN-VLAN50 permit ip any any

access-list OUT-VLAN50 permit icmp 192.168.1.0 0.0.0.31 192.168.1.128 0.0.0.31

access-list OUT-VLAN50 deny icmp any any

access-list OUT-VLAN50 permit ip any any

Interface vlan 50

ip access-group IN-VLAN50 in

ip access-group OUT-VLAN50 out

:-)

[ehsan]

Thanks a lot Julio Moisa it works for me.... :-)

[Julio E. Moisa]

Hi

I am glad to know it worked, have a great day!

:-)

[ranilf2005]

Recommended for applying ACL on ingress SVI interface locally.

Hope this URL will assist you

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_vlanacls.pdf