Hi
just to mention, if you are going to use VLAN ACL, you need to allow the communication in 2 ways, because it does not work as stateful like firewalls, otherwise it will not work properly, once you have allowed the communication in both ways with different ACLs you could create a deny at the last access-map, a simple example:
Step 1- Create the ACLs for inbound, outbound and deny traffic:
ip access-list extended OUTBOUND-TRAFFIC
permit tcp 192.168.1.0 0.0.0.255 any
ip access-list extended INBOUND-TRAFFIC
permit tcp any 192.168.1.0 0.0.0.255
ip access-list extended DENY-ELSE-TRAFFIC
permit ip any any
Step 2: Associate the ACL with the access-map in sequence. It wil be read from the top to the bottom.
vlan access-map VLAN_TRAFFIC 5
match ip address OUTBOUND-TRAFFIC
action forward
vlan access-map VLAN_TRAFFIC 10
match ip address INBOUND-TRAFFIC
action forward
vlan access-map VLAN_TRAFFIC 100
match ip address DENY-ELSE-TRAFFIC
action drop
Step 3: And the final step is apply the access-map to a VLAN or several VLANS
vlan filter VLAN_TRAFFIC vlan-list <vlan X>
I have highlighted in different colors to take in consideration. Also take in consideration if you are going to use object-groups (not all the switches support that) check the CPU utilization during the implementation.
Other way additional to VACL and ACL is install a firewall to block or allow traffic.
Hope it is useful
:-)
>> Marcar como útil o contestado, si la respuesta resolvió la duda, esto ayuda a futuras consultas de otros miembros de la comunidad. <<
