Link to home
Start Free TrialLog in
Avatar of greekstones
greekstonesFlag for United States of America

asked on

CISCO 1801 access lit between vlans

I'm trying to add an access list between vlans.

i want to deny source 172.16.1.0 255.255.255.0 destination 172.16.2.0 255.255.255.0

but
 i want to permit 172.16.2.0 255.255.255.0 to access the 172.16.1.0 255.255.255.0

i tryed but it doesn't work .  can you please help with the configuration and possitioning the access list in or out

please view my router configuration

1801-router.txt
Avatar of Vito_Corleone
Vito_Corleone
Flag of United States of America image

You cannot deny traffic on one side and permit it on the other, you will end up denying return traffic. You need two way communication. You can try this:

ip access-list VLAN200_IN
 permit tcp any any established
 deny ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
 permit ip any any
!
interface Vlan200
 ip address 172.16.1.1 255.255.255.0
 ip access-group VLAN200_IN in

It will allow return TCP traffic, but you will still drop UDP flows.
Avatar of greekstones

ASKER

hi there

thanks for your reply

yes that works for all traffic but the icmp is not working.  I can not ping between 172.16.2.4 to 172.16.1.100

also what is the permit tcp any any established does ? becuase i never seen this before.

regards.
 
ASKER CERTIFIED SOLUTION
Avatar of Vito_Corleone
Vito_Corleone
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
great yes it worked

here is another 500 points.