Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am designing a topology with one Core Switch and around 6 Edge Switches with around 10 Vlans managed through the VTP Server running on Core Switch. Inter Vlan routing is also enabled on the core switch.

Now I need to restrict traffic into one particular Vlan. I know how to write the statements using Extended Access List and apply it on an interface in a Router, but how do I create an Access List / Filter condition in the Core Switch to govern traffic going to that particular VLAN ?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You should be able to treat the vlan similar to an interface like the following:

access-list 101 permit ip 10.10.10.0 0.0.0.255 10.10.9.0 0.0.0.255
access-list 101 deny ip any any
interface vlan 2
ip access-group 101 in

That should give you the general idea. More examples are available at Cisco's web site, one I have used is: http://www.cisco.com/en/US/tech/tk389/tk689/technologies_configuration_example09186a008009478e.shtml#howto

share|improve this answer
    
So we can in fact apply extended access list to an interface vlan in an L3 switch? That is a big relief!! Thanks a lot, :D –  gokul varma nk Sep 14 '11 at 14:01
    
Yes you can, the vlan access-list restriction adds a small processing load to your switch, but it's worth it if you need to restrict that traffic :-). –  Mister_Tom Sep 14 '11 at 14:05
    
Off to test it and thanks once again, :) –  gokul varma nk Sep 14 '11 at 14:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.