VLAN ACL not blocking traffic

[meiser1985]

I am trying to restrict a VLAN120 from accessing VLAN504. Here is what I have.

VLAN120 10.1.50.0

VLAN504 10.1.98.0

Extended IP access list voip

    50 deny ip any 10.1.98.0 0.0.0.255

    100 permit ip any any

interface Vlan120

description

ip address 10.1.50.1 255.255.255.0

ip access-group voip out

When I set "ip access-group voip in" it will block reply packets from VLAN504 but I want to eliminate the packets from leaving VLAN120 to VLAN504.

[Richard Burts]

What kind if switch is this? Is IP routing enabled on this switch? Is this switch routing for vlan 120? How do you know that the access list is not blocking traffic (what is your test)?

HTH

Rick

[Jon Marshall · Accepted solution]

You need to apply the acl inbound on the vlan 120 interface and not outbound as you have.

Inbound means traffic coming from clients in that vlan. You have used "any" rather than the specific vlan 120 subnet but it doesn't matter.

Edit - if you apply it outbound to the vlan 120 interface as you have it should not block return packets because the destination IPs of the return packets would be 10.1.50.x so it would only match the permit line.

Jon

[glen.grant]

  The way you have it written you would have had to put it on vlan 504 in the out direction, then it should work .   If you want to block it from leaving a vlan then it will always be in the  "in" direction.

[Jon Marshall]

Glen

You could apply it outbound in the way you describe but you would probably want to change the "any" in the deny line otherwise you have just isolated that vlan from communicating with any other vlan as the permit line would never be matched.

Jon

[glen.grant]

  Your right Jon it should be the other vlan range instead of any .