VLAN ACL

[hs08]

Hello,

How we can make vlan access list to permit traffic from host in vlan A to vlan B but deny traffic from host in vlan B to vlan A

[Joseph W. Doherty]

Don't believe so, unless you mean two way communication, but why do you believe so?

[Joseph W. Doherty]

How?

Either an egress ACL on VLAN B's SVI blocking traffic to VLAN A's IPs, or an ingress ACL on VLAN A's SVI blocking traffic from VLAN B's IPs.

BTW, although either ACL will accomplish your stated goal, blocking all traffic in one direction tends to break most network protocols as they expect two way communication.

[MHM Cisco World · Accepted solution]

Now until I run lab and share config I will provide you some point 
traffic must classify into 
UDP <<- here you must allow traffic between VLAN's
TCP <<- you can use reflexive ACL or established keyword in acl 
 https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-mt/sec-data-acl-15-mt-book/sec-cfg-ip-filter.html
ICMP <<- this need allow only the echo-reply not echo from VLAN B to VLAN A 

that how should your ACL config. 

[Joseph W. Doherty]

"that how should your ACL config."

BTW, I did, early on, mention the stated requirement would break most network protocols as they expect two way communication, but OP did not revise requirement.

What you're describing is along the (more real-world) lines of VLAN A can initiate two communication with VLAN B, but the converse is not to be allowed.  (I.e. firewall like or firewall lite communications.)

Also BTW, reflexive ACLs also support (some) non-TCP protocols too; your reference mentions using reflexives ACLs with TCP, UDP, ICMP, IGMP and other protocols.  I.e. using reflexive ACLs may negate your UDP and ICMP statements.

[hs08]

Hello,

Now i undertand to full fill my request i should not permit ip because with pemit ip traffic from vlan 10 can be communicate woth vlan 20 and vice versa. I should use spesific permit port and protocol rather than use permit ip. Am i right?

[MHM Cisco World]

Yes you are correct.

[Joseph W. Doherty]

"Am I right?"

With regard to your (repeatedly) stated goal/requirement, no!

If your goal/requirement is NOW is to allow SOME two way traffic from VLAN 20 to VLAN 10, then you will need additional ACEs before the ACEs in the ACLs I provided, unless you want to block VLANs 10 & 20 from any other networks not in their VLANs.

When @MHM Cisco World suggested using TCP's established and/or reflexive ACLs, that's a wildcard match for lots of traffic (which is quite fine if that's your goal/requirement).

Again, YOU need to be precise in what you want to accomplish, or likewise, and more often the case, obtain from whoever you are working with exactly what's the desired results.