Solved

Cisco 3560 Switch - Disable Routing Between two VLANs

Posted on 2010-11-17
11
1,478 Views
Last Modified: 2012-05-10
Need to prevent communication between VLAN 2 and VLAN3.  Both need to be able to route out through VLAN 1.

Current IP route statement is 0.0.0.0 0.0.0.0 10.30.1.1

Network 1: 10.30.1.0/24  (VLAN 1)
Network 2: 10.30.10.0/24  (VLAN 2)
Network 3: 10.30.20.0/24  (VLAN 3)

How do I disable routing between VLAN 2 and VLAN 3?  Please provide commands.



0
Comment
Question by:ohmErnie
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 2
11 Comments
 
LVL 34

Accepted Solution

by:
Istvan Kalmar earned 250 total points
ID: 34159572
Hi,

you need:
int vlan 2
 ip access-group 101 in
access-list 101 deny ip 10.20.10.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 101 permit ip any any
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34159578
sorry this acl need for you:

access-list 101 deny ip 10.30.10.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 101 permit ip any any
0
 
LVL 7

Assisted Solution

by:joelvp
joelvp earned 250 total points
ID: 34159582
conf t
ip access-list e DENYVLAN3
deny ip any 10.30.20.0 255.255.255.0
permit ip any any

ip access-list e DENYVLAN2
deny ip any 10.30.10.0 255.255.255.0
permit ip any any

int vlan2
ip access-group DENYVLAN3 in

int vlan3
ip access-group DENYVLAN2 in


0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 7

Expert Comment

by:joelvp
ID: 34159593
Sorry, mine is wrong
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159612
this is what it should have been (but ikalmar already gave the right coding):
conf t
ip access-list e DENYVLAN3
deny ip any 10.30.20.0 0.0.0.255
permit ip any any

ip access-list e DENYVLAN2
deny ip any 10.30.10.0 0.0.0.255
permit ip any any

int vlan2
ip access-group DENYVLAN3 in

int vlan3
ip access-group DENYVLAN2 in

0
 
LVL 1

Author Comment

by:ohmErnie
ID: 34159800
How would I change this to a permit only?  Say I only want the network x.x.x.x to have access to 10.30.20.0/24 and deny everything else.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34159828
access-list 102 permit ip x.x.x.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 102 deny ip any any
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159868
the line
access-list 102 deny ip any any
is not needed as it is implicit

and you would need to code also:
int vlan3
ip access-group 102 out
0
 
LVL 1

Author Comment

by:ohmErnie
ID: 34166129
If I have two 3560g switches connected via a SFP GB Module, do I need to create this list on both switches?
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34170708
On which of the switches are the vlan interfaces defined? Or are you using HSRP? In the latter case you would have to do the job on both switches, otherwise the switch on which the interfaces are defined is sufficient.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34171160
please show booth switches config..

0

Featured Post

Creating Instructional Tutorials  

For Any Use & On Any Platform

Contextual Guidance at the moment of need helps your employees/users adopt software o& achieve even the most complex tasks instantly. Boost knowledge retention, software adoption & employee engagement with easy solution.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Suggested Courses

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question