Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a single network/VLAN and I want to block some traffic and allow some traffic in my network, is this possible using a L2 or L3 switch? If so which switches support this feature and what would be the commands to configure this?

I have already tried this using access lists by applying it to an ethernet port but if I apply it on one port it will automatically work on incoming traffic on that port but I mean it to work on only outgoing traffic as per my ACL.

Do you have any suggestions please?

share|improve this question

With most Cisco switches, you can apply ACLs on switch ports without going any routing trouble. This works with L2 switchs such as the Catalyst 2960G.

share|improve this answer

Access lists (at a basic level) only apply to layer 3 VLANs (think config "interface vlan 10" rather than "vlan 10") - on switches. If you are applying one to an interface you will need to convert the interface to a routed port using the "no switchport" command.

This is only possible with layer 3 switches, because layer 2 switches do not see the layer 3/4 information you are trying to filter on - the TCP and UDP port numbers. Layer 2 is dealing with MAC addresses.

The answer is to create layer 3 VLANs on a core layer 3 switch. The IP address of these VLANs becomes the default gateway for computers which you assign to those VLANs. You will also need to assign ports to the corresponding VLANs and set up trunk links between your switches to carry the layer 2 VLAN info.

share|improve this answer

If you've got a layer 3 switch that you could apply IP addresses to each interface on, you could use ACLs to filter traffic passing between interfaces; essentially turning the port on the switch into a router port and then the switch routes between ports.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.