setup 1 way communication on vlans on a 3850 switch

[mmercaldieze]

I have a client that does not want to do this on his ASA, he instead wants this setup on a 3850 switch.  They basically are trying to create a DMZ vlan, VLAN 10.  The servers are on VLAN 5.  They want VLAN 5 to have full access to VLAN 10, but VLAN 10 to have no access at all to VLAN 5.   I know on an ASA this is really simple but on a switch I am not sure, and also setting up zone based firewall on this switch is not an option.

[Ton V Engelen]

HI you could do this with an acl. 

Suppose vlan 10 has an SVI with 10.1.1.1/24 and vlan 5 has an SVI with 10.1.2.1/24

Block vlan 10 to vlan 5: 

ip access-list ext BLOCK-V10

10 deny ip 10.1.1.0 0.0.0.255 any

20 permit ip any any

interface VLAN 5

ip access-group BLOCK-V10 out

[mmercaldieze]

ok thanks I will try that