Posted on 2012-08-13
Last Modified: 2012-08-20
I have 3 vlans /

VLAN 1    (192.168.1.x)
VLAN 50  (192.168.50.x)
VLAN 51  (192.168.51.x)

VLAN 51 is a guest vlan / I would like to craft up an access list that would restrict it to VLAN 50 and VLAN 1 / but allow VLAN 1 to access VLAN 51.

interface Vlan51
 ip access-group 51 in
access-list 51 deny   ip any log
access-list 51 permit ip any any log

When applying this access list - VLAN 51 is indeed restricted from VLAN 1 and VLAN 50

But VLAN 1 can no longer access VLAN 51 /
Question by:yostnet
    LVL 50

    Expert Comment

    by:Don Johnston
    Except for streaming multicast, traffic is bi-directional. So if you want VLAN 1 to access VLAN 51, then VLAN 51 must be able to access VLAN 1.

    Author Comment


    ok ---- no way around that?
    LVL 43

    Accepted Solution

    If primarily TCP connectivity, you can allow return traffic from vlan51 to vlan1 using the established option.  You can also allow return ICMP traffic only if desired.

    Add to the top of the access-list:

    access-list 51 permit tcp any any established  <--allow return TCP traffic initiated from VLAN1
    access-list 51 permit icmp any any echo-reply   <---allow return ICMP traffic
    access-list 51 deny   ip any log
    access-list 51 permit ip any any log

    Author Closing Comment

    thank you!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Highfive Gives IT Their Time Back

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    I see many questions here on Experts Exchange regarding switch port configurations and trunks. This article is meant for beginners in the subject to help to get basic knowledge about Virtual Local Area Network (VLAN (…
    This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now