• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 728
  • Last Modified:

Access-lists on Cisco 3550 switches

Below is a digram of my network.  Right now all networks can talk to each other.  For example, if I am on a server in the 10.4.0.0 network, from there I can RDP into a server in the 10.5.0.0 network.  I need to create a access-list so these networks can't talk to each other.  I am using VTP, thats why all switches share a common VLAN.  Can someone provide me with an access-list example to accomplish this.  thanks.


Switch Diagram
0
denver218
Asked:
denver218
  • 3
  • 2
1 Solution
 
Ken BooneNetwork ConsultantCommented:
So if you are on vlan 30 you do not want to get to vlan 40 or vlan 50?  Is that correct?  Should vlan 30 be allowed to get to the internet or any other networks?
0
 
denver218Author Commented:
Yes if I am on vlan 30, I don't want to see vlan 40 or 50.  I do want all network to have access to the internet.  Thanks.
0
 
denver218Author Commented:
I do have an Cisco ASA5510 on this network.  Should I just create an access-list on the inside for this on the ASA5510 instead of creating the access-list on switches?
0
 
Ken BooneNetwork ConsultantCommented:

Here is the ACL for vlan 30 - this blocks access to vlan 40 and 50 and allows everything else.
ip access-list extended vlan30-acl
deny ip any 10.5.0.0 0.0.255.255
deny ip any 10.6.0.0 0.0.255.255
permit ip any any


Then on
interface vlan30
access-group vlan30-acl in


No you need to it on the switch instead of the asa.
0
 
denver218Author Commented:
That worked.  Thanks
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now