1

I have a Dell 6224 powerconenct switch acting as the core switch on our network. I have a number of VLANs configured, and the time has come for us to now consider blocking traffic between specific VLANs.

I currently use VLANs 2 - 10 and their respective subnets are 10.58.v.0/24 (where v is the VLAN ID). The router interface on each VLAN is 10.58.v.1

For example VLAN 5 uses 10.58.5.0/24, with a gateway of 10.58.5.1

What I want to do, is to block all IP traffic between VLAN 5 and VLAN 8, i.e. anything with an IP in the range of 10.58.5.0/24 can't communicate with anything in 10.58.8.0/24 and vice versa.

As this is a production network (and I don't have a test environment available), I don't want to just start creating ACLs, in case I mess up.

My first thought was to create an access list such as..

access-list testacl deny ip 10.58.5.0 255.255.255.0 10.58.8.0 255.255.255.0

But I don't really know if this needs to be assigned to a specific interface?

Update:

I've been reading further and realise that I now need to add a permit rule, for everything else, otherwise the implied deny all rule will block everything, so my testacl now looks like this:

access-list testacl deny ip 10.58.5.0 255.255.255.0 10.58.8.0 255.255.255.0
access-list testacl permit every

But I'm still unsure if this is correct, and would appreciate any assistance, as I don't want to risk reconfiguring production switches without fully understanding other possible side effects of what I'm doing.

2
  • What does the existing routing table look like on the switch?
    – Helvick
    Dec 4, 2010 at 11:19
  • routing is enabled on all interfaces (except the management VLAN), and a default route exists for 0.0.0.0/0 to our internet connection.
    – Bryan
    Dec 4, 2010 at 11:25

1 Answer 1

2

I hate answering my own questions, but as I've now resolved this, this might help someone else.

Firstly, the netmask above is incorrect, I should have used a Wild Card Mask

After some research I found that the correct commands to create the ACL were:

access-list testacl deny ip 10.58.5.0 0.0.0.255 10.58.8.0 0.0.0.255
access-list testacl permit every

...and to apply the ACL, I used the following:

interface vlan 5
ip access-group testacl

After the research I did, I felt confident to apply the ACL to the production switches, and the change worked flawlessly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .