Router on a stick - One way access to VLAN

[wetfish]

Hi,

I am new to ACLs as I am still sitting for the CCNA course.

I created a router on a stick with 2 VLANs.

VLAN_A: 192.168.1.0/24

VLAN_B: 192.168.2.0/24

I would like to create an access list where VLAN_A is NOT allowed any access to anything on VLAN_B.

However, I want VLAN_B to have FULL access to VLAN A.

Is this scenario possible with ACLs please? If so, can someone please give me some hints to try out on packet tracer?

Thanks a lot in advance

[Joseph W. Doherty]

Perhaps what would come closest to your ACL requirement would be using a reflexive ACL in conjunction with an established TCP ACE. Don't know if Packet Tracer supports them.

Even better than an ACL, for your requirement goal, would be the firewall feature set.

[Deepak Kumar]

Hi, 

ACL configuration as below:

IP access-list extended VLAN-B-Block

10 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

20 permit ip any any

IP access-list extended VLAN-A-Block

10 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

20 permit ip any any

Apply the ACL under the VLAN to outside.

interface VLAN_A

ip access-group VLAN-B-Block out

interface VLAN_B

ip access-group VLAN-A-Block out

Regards,

Deepak Kumar

[Joseph W. Doherty]

Kumar, I may be misreading what you've posted, but aren't these ACLs blocking all traffic between VLANs A and B?

[Richard Burts · Accepted solution]

I agree with Joseph that the suggestion from Kumar will block all traffic and therefore does not satisfy the requirement in the original post that vlan B have full access to vlan A. I also agree with Joseph that allowing vlan A to generate responses to packets received from vlan B while denying vlan A to initiate packets to vlan B is difficult and can not be fully achieved using just ACL. Reflexive ACL or other firewall features are required to achieve this.

HTH

Rick

[wetfish]

Thanks a lot for your fast replies. As you stated, reflexive ACLs are the solution. Unfortunately, packet tracer does not support reflexive ACLs but I saw some YouTube video on what you explained and I understood my scenario.

Thanks a lot

[Joseph W. Doherty]

You might also check if Packet Tracer supports an established TCP ACE. If if does, that would meet your goal at least for TCP based traffic.

[Richard Burts]

I am glad that our suggestions have been helpful. Thank you for marking this question as solved. This will help other readers in the forum to identify discussions that have helpful information. These forums are excellent places to ask questions and to learn about networking. I hope to see you continue to be active in the forum.

HTH

Rick

[Deepak Kumar]

Hi, 

This was my bad that I didn't get his comments fully. 

Regards,

Deepak kumar

[Richard Burts]

We all do this from time to time where we get part of what is being asked but miss a part of what is being asked. One of the advantages of these forums is that with multiple people participating the missing part is usually identified and answered. You have been a good participant in the forums and I look forward to your continuing participation.

HTH

Rick

[Joseph W. Doherty]

Ditto to what Rick says.

[Deepak Kumar]

@Joseph W. Doherty  @Richard Burts 

Thank you for giving me the courage

Regards,

Deepak Kumar