Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am designing a topology with one Core Switch and around 6 Edge Switches with around 10 Vlans managed through the VTP Server running on Core Switch. Inter Vlan routing is also enabled on the core switch.

Now I need to restrict traffic into one particular Vlan. I know how to write the statements using Extended Access List and apply it on an interface in a Router, but how do I create an Access List / Filter condition in the Core Switch to govern traffic going to that particular VLAN ?

share|improve this question
up vote 2 down vote accepted

You should be able to treat the vlan similar to an interface like the following:

access-list 101 permit ip
access-list 101 deny ip any any
interface vlan 2
ip access-group 101 in

That should give you the general idea. More examples are available at Cisco's web site, one I have used is:

share|improve this answer
So we can in fact apply extended access list to an interface vlan in an L3 switch? That is a big relief!! Thanks a lot, :D – gokul varma nk Sep 14 '11 at 14:01
Yes you can, the vlan access-list restriction adds a small processing load to your switch, but it's worth it if you need to restrict that traffic :-). – Mister_Tom Sep 14 '11 at 14:05
Off to test it and thanks once again, :) – gokul varma nk Sep 14 '11 at 14:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.