up vote 0 down vote favorite
share [g+] share [fb]

I was wondering how VLAN access control is set for the CISCO 2950?

I have the following scenario:

4 Switches 9 VLANs

Switch 1: VLAN 1, VLAN 2, VLAN 3, VLAN 4, VLAN 5

Switch 2: VLAN 2, VLAN 3, VLAN 5, VLAN 6, VLAN 9

Switch 3: VLAN 3, VLAN 4, VLAN 7, VLAN 8

Switch 4: VLAN 3, VLAN 7, VLAN 8, VLAN 9

How would I set it up for access control. For example, I would like to have VLAN 3 to be able to access all VLANs, but all other VLANs cannot access VLAN 3 except for VLANs 4 + 5.

UPDATE: There is also a CISCO 2611 Router connected to a trunked port in one of the switches

link|improve this question
75% accept rate
feedback

2 Answers

up vote 0 down vote accepted

You say you have a trunked interface to your router, so I assume you are using a vlan interface. And lets say for example that

  • vlan 3 is subnet 3.3.3.0/24
  • vlan 4 is subnet 4.4.4.0/24
  • vlan 5 is subnet 5.5.5.0/24

You need something like this on your router...

access-list 30 permit ip 3.3.3.0 0.0.0.255

access-list 31 permit ip 4.4.4.0 0.0.0.255
access-list 31 permit ip 5.5.5.0 0.0.0.255

interface vlan 3
ip access-group 30 in
ip access-group 31 out

Hope that helps

link|improve this answer
feedback
up vote 4 down vote

The 2950 is primarily a Layer 2 switch. As such, it does not know how to pass traffic between VLANs. You'll need to get a Layer 3 device involved to do routing and access control between VLANs/subnets.

link|improve this answer
Oh, I forget to mention, one of the switch has a trunk port and is connected to a router. – YTKColumba Sep 13 '11 at 2:58
Then you will need to set up routes and ACLs on the router for your desired config. – ErikA Sep 13 '11 at 2:59
Could you please give an example? I read some information online about the ACL, but I am not sure how to implement it. – YTKColumba Sep 13 '11 at 3:13
I'm not a Cisco expert, so sorry, no can do. You probably ought to either completely re-work this question or ask a new question specifically about setting up ACLs and routes on the 2611. – ErikA Sep 13 '11 at 3:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.