Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand that a BVI is very much equivalent to a network switch. But it includes the benefit of being able to have an access control list.

I am doing this, but I would like to more effectively distinguish incoming vs outgoing. Right now, all I have to go on is the IP address.

How can I add a protection against IP spoofing? I would like to prevent someone on the WAN port (FastEthernet4) from using one of the IP addresses that are only supposed to exist the LAN port.

share|improve this question

Apply inbound filters on the physical device that is bridged by the BVI.

bridge irb
 no ip address
 bridge-group 1
 ip access group 101 in
interface BVI 1
bridge 1 route ip
access-list 101 deny   ip YOUR IPS any log
access-list 101 permit ip any any
share|improve this answer
It didn't work. For some reason I was not able to stop an IP using access list 101 deny ip host ??.??.??.?? any. That outside IP was still able make TCP connections with the servers on the LAN ports. Any idea why? – George Bailey Nov 15 '11 at 23:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.