Solved

Cisco 3560 Switch - Disable Routing Between two VLANs

Posted on 2010-11-17
11
1,425 Views
Last Modified: 2012-05-10
Need to prevent communication between VLAN 2 and VLAN3.  Both need to be able to route out through VLAN 1.

Current IP route statement is 0.0.0.0 0.0.0.0 10.30.1.1

Network 1: 10.30.1.0/24  (VLAN 1)
Network 2: 10.30.10.0/24  (VLAN 2)
Network 3: 10.30.20.0/24  (VLAN 3)

How do I disable routing between VLAN 2 and VLAN 3?  Please provide commands.



0
Comment
Question by:ohmErnie
  • 5
  • 4
  • 2
11 Comments
 
LVL 34

Accepted Solution

by:
Istvan Kalmar earned 250 total points
ID: 34159572
Hi,

you need:
int vlan 2
 ip access-group 101 in
access-list 101 deny ip 10.20.10.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 101 permit ip any any
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34159578
sorry this acl need for you:

access-list 101 deny ip 10.30.10.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 101 permit ip any any
0
 
LVL 7

Assisted Solution

by:joelvp
joelvp earned 250 total points
ID: 34159582
conf t
ip access-list e DENYVLAN3
deny ip any 10.30.20.0 255.255.255.0
permit ip any any

ip access-list e DENYVLAN2
deny ip any 10.30.10.0 255.255.255.0
permit ip any any

int vlan2
ip access-group DENYVLAN3 in

int vlan3
ip access-group DENYVLAN2 in


0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159593
Sorry, mine is wrong
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159612
this is what it should have been (but ikalmar already gave the right coding):
conf t
ip access-list e DENYVLAN3
deny ip any 10.30.20.0 0.0.0.255
permit ip any any

ip access-list e DENYVLAN2
deny ip any 10.30.10.0 0.0.0.255
permit ip any any

int vlan2
ip access-group DENYVLAN3 in

int vlan3
ip access-group DENYVLAN2 in

0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 1

Author Comment

by:ohmErnie
ID: 34159800
How would I change this to a permit only?  Say I only want the network x.x.x.x to have access to 10.30.20.0/24 and deny everything else.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34159828
access-list 102 permit ip x.x.x.0 0.0.0.255 10.30.20.0 0.0.0.255
access-list 102 deny ip any any
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34159868
the line
access-list 102 deny ip any any
is not needed as it is implicit

and you would need to code also:
int vlan3
ip access-group 102 out
0
 
LVL 1

Author Comment

by:ohmErnie
ID: 34166129
If I have two 3560g switches connected via a SFP GB Module, do I need to create this list on both switches?
0
 
LVL 7

Expert Comment

by:joelvp
ID: 34170708
On which of the switches are the vlan interfaces defined? Or are you using HSRP? In the latter case you would have to do the job on both switches, otherwise the switch on which the interfaces are defined is sufficient.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 34171160
please show booth switches config..

0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Cisco MRA Phones 4 15
FTP output from Wireshak 6 50
MOVING OFFICE / SERVER 22 74
Extending  a subnet 9 37
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now