Vlan Separation with ACL's

[RyanDundee]

So, I am playing around with a router. I have 4 vlans and I dont want any of them to be able to communicate with each other. Not sure the best way to accomodate this. Here is my thought... Please feel free to critique.

ip access-list extended Vlan1-ACL

deny  ip vlan1subnet 0.0.0.255 host vlan2

deny  ip vlan1subnet 0.0.0.255 host vlan3

deny  ip vlan1subnet 0.0.0.255 host vlan4

permit ip any any

ip access-list extended Vlan2-ACL

deny  ip vlan2subnet 0.0.0.255 host vlan1

deny  ip vlan2subnet 0.0.0.255 host vlan3

deny  ip vlan2subnet 0.0.0.255 host vlan4

permit ip any any

ip access-list extended Vlan3-ACL

deny  ip vlan3subnet 0.0.0.255 host vlan1

deny  ip vlan3subnet 0.0.0.255 host vlan2

deny  ip vlan3subnet 0.0.0.255 host vlan4

permit ip any any

ip access-list extended Vlan4-ACL

deny  ip vlan4subnet 0.0.0.255 host vlan1

deny  ip vlan4subnet 0.0.0.255 host vlan2

deny  ip vlan4subnet 0.0.0.255 host vlan3

permit ip any any

Thanks!

[Abzal]

Hi,

Second option you can use Private-VLAN but it is done by switches L2 separation.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/pvlans.html

Hope it will help.

Best regards,
Abzal

[milan.kulik]

Hi,

why

deny  ip vlan1subnet 0.0.0.255 host vlan2 ?

Shoudln't be

deny  ip vlan1subnet 0.0.0.255 vlan2subnet 0.0.0.255 ?

etc.

(Supposing all your subnets are /24.)

HTH,

Milan