Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Cisco 3560 Switch - Disable Routing Between two VLANs

Posted on 2010-11-17
11
Medium Priority
?
1,499 Views
Last Modified: 2012-05-10
Need to prevent communication between VLAN 2 and VLAN3.  Both need to be able to route out through VLAN 1.

Current IP route statement is 0.0.0.0 0.0.0.0 10.30.1.1

Network 1: 10.30.1.0/24  (VLAN 1)
Network 2: 10.30.10.0/24  (VLAN 2)
Network 3: 10.30.20.0/24  (VLAN 3)

How do I disable routing between VLAN 2 and VLAN 3?  Please provide commands.



0
Comment
Question by:ohmErnie
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 2
11 Comments
 
LVL 34

Accepted Solution

by:
Istvan Kalmar earned 1000 total points
ID: 34159572
Hi,

you need:
int vlan 2
 ip access-group 101 in
access-list 101 deny ip 10.20.10.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 101 permit ip any any
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34159578
sorry this acl need for you:

access-list 101 deny ip 10.30.10.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 101 permit ip any any
0
 
LVL 7

Assisted Solution

by:joelvp
joelvp earned 1000 total points
ID: 34159582
conf t
ip access-list e DENYVLAN3
deny ip any 10.30.20.0 255.255.255.0
permit ip any any

ip access-list e DENYVLAN2
deny ip any 10.30.10.0 255.255.255.0
permit ip any any

int vlan2
ip access-group DENYVLAN3 in

int vlan3
ip access-group DENYVLAN2 in


0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 7

Expert Comment

by:joelvp
ID: 34159593
Sorry, mine is wrong
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159612
this is what it should have been (but ikalmar already gave the right coding):
conf t
ip access-list e DENYVLAN3
deny ip any 10.30.20.0 0.0.0.255
permit ip any any

ip access-list e DENYVLAN2
deny ip any 10.30.10.0 0.0.0.255
permit ip any any

int vlan2
ip access-group DENYVLAN3 in

int vlan3
ip access-group DENYVLAN2 in

0
 
LVL 1

Author Comment

by:ohmErnie
ID: 34159800
How would I change this to a permit only?  Say I only want the network x.x.x.x to have access to 10.30.20.0/24 and deny everything else.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34159828
access-list 102 permit ip x.x.x.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 102 deny ip any any
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159868
the line
access-list 102 deny ip any any
is not needed as it is implicit

and you would need to code also:
int vlan3
ip access-group 102 out
0
 
LVL 1

Author Comment

by:ohmErnie
ID: 34166129
If I have two 3560g switches connected via a SFP GB Module, do I need to create this list on both switches?
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34170708
On which of the switches are the vlan interfaces defined? Or are you using HSRP? In the latter case you would have to do the job on both switches, otherwise the switch on which the interfaces are defined is sufficient.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34171160
please show booth switches config..

0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question