cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1609
Views
15
Helpful
5
Replies

VLAN blocking

RJohn
Level 1
Level 1

Hi, 

I've attached my pkt file for reference.

 

Thanks in advance,

1 Accepted Solution

Accepted Solutions

Hello

A simple RACL applied to switch 0 should but sufficient.

access-list 100 deny ip any host 172.16.15.10
access-list 100 permit ip any any

int vlan 60
ip accces-group 100 in

int vlan 80
ip accces-group 100 in


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

View solution in original post

5 Replies 5

Seb Rupik
VIP Alumni
VIP Alumni

I don't have PT so can't open your file, but what you need is an ACL placed on the CRM SVI in the outbound direction.

Something like:

!
ip access-list ext CRM_ACL
  deny ip 192.168.1.0 0.0.0.255 192.168.20.0 0.0.0.255 ! deny VLAN60
  deny ip 192.168.2.0 0.0.0.255 192.168.20.0 0.0.0.255 ! deny VLAN80
  permit ip any any
!
int vlan 300
  desc CRM
  ip access-group CRM_ACL out
!

where 192.168.1.0/24 is VLAN60

192.168.2.0/24 is VLAN80

192.168.20.0/24 is the CRM VLAN


cheers,
Seb.

Hello @Seb Rupik 
As you cannot see the topology just thought you let you know mate it looks like the l3 SVIs are separated via a router so denying the traffic at the source of the CRM would indeed deny the traffic however that traffic would need to traverse the network prior to it being denied.


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Hello

A simple RACL applied to switch 0 should but sufficient.

access-list 100 deny ip any host 172.16.15.10
access-list 100 permit ip any any

int vlan 60
ip accces-group 100 in

int vlan 80
ip accces-group 100 in


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Hi Paul,

 

Thank you very much for your response. When you say switch 0 - do you mean the multilayer switch 0?

 

Thanks 

Hello
Yes apologies i should have been clearer in my post! - Basically you are denying initiated traffic from these vlans towards that CRM device before it can traverse the network


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul