Solved

Block VLan access

Posted on 2013-01-08
3
304 Views
Last Modified: 2013-02-05
Hi,


I want to block access to a 10.x.x.x network from a 172.16.x.x vlan and not sure of the best way to do this. I was thinking of using extended access lists and simply applying those to the vlan but was wondering if there were any better suggestions which might make this more easier.
0
Comment
Question by:dcirona86
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 1

Expert Comment

by:thpipfh
ID: 38757661
I have given some example for this... please understand the same.

===============
ip access-list extended BAN_VLAN_20
permit tcp 10.10.20.0 0.0.0.255 established
deny   tcp 10.10.20.0 0.0.0.255 any
permit ip any any
!
interface Vlan100
description SVI_VLAN100
ip address 10.10.100.254 255.255.255.0
ip access-group BAN_VLAN_20 out
!
 
 
The above would block the 10.10.20.0 network from initiating access to the 10.10.100.0 network via TCP protocols such as Telnet or SSH.  However, if 10.10.100.0 network initiated the connection then with the "permit tcp 10.10.20.0 0.0.0.255 established" added the return traffic from the 10.10.20.0 network would be allowed.  This will allow the 10.10.100.0 network, your management Vlan, to access the 10.10.20.0 network hosts via TCP protocols, such as the Telnet and SSH for management.
 ========================
0
 
LVL 9

Accepted Solution

by:
Sandeep Gupta earned 250 total points
ID: 38757885
Hi,

Here is one good documnet to learn more on vlan access map, vlan acl..you can go thru it if time permits you.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vacl.pdf
0
 
LVL 22

Expert Comment

by:eeRoot
ID: 38761141
For a small number of VLAN's that need to be isolated, ACL's are the best option.  For a large number of VLAN's, where managing a lot of ACL's would become difficult, you can use private VLAN's.

These articles from Cisco explain private VLAN's
http://www.cisco.com/en/US/tech/tk389/tk814/tk840/tsd_technology_support_sub-protocol_home.html
http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
adjusting startup config 6 73
BGP recommended setup with failover 2 102
Bandwidth cap???? 8 93
How to separate mgmt & production vm network 8 68
There are times where you would like to have access to information that is only available from a different network. This network could be down the hall, or across country. If each of the network sites have access to the internet, you can create a ne…
Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question