I have a Dell 6224 powerconenct switch acting as the core switch on our network. I have a number of VLANs configured, and the time has come for us to now consider blocking traffic between specific VLANs.

I currently use VLANs 2 - 10 and their respective subnets are 10.58.v.0/24 (where v is the VLAN ID). The router interface on each VLAN is 10.58.v.1

For example VLAN 5 uses, with a gateway of

What I want to do, is to block all IP traffic between VLAN 5 and VLAN 8, i.e. anything with an IP in the range of can't communicate with anything in and vice versa.

As this is a production network (and I don't have a test environment available), I don't want to just start creating ACLs, in case I mess up.

My first thought was to create an access list such as..

access-list testacl deny ip

But I don't really know if this needs to be assigned to a specific interface?


I've been reading further and realise that I now need to add a permit rule, for everything else, otherwise the implied deny all rule will block everything, so my testacl now looks like this:

access-list testacl deny ip
access-list testacl permit every

But I'm still unsure if this is correct, and would appreciate any assistance, as I don't want to risk reconfiguring production switches without fully understanding other possible side effects of what I'm doing.

  • What does the existing routing table look like on the switch? – Helvick Dec 4 '10 at 11:19
  • routing is enabled on all interfaces (except the management VLAN), and a default route exists for to our internet connection. – Bryan Dec 4 '10 at 11:25
up vote 2 down vote accepted

I hate answering my own questions, but as I've now resolved this, this might help someone else.

Firstly, the netmask above is incorrect, I should have used a Wild Card Mask

After some research I found that the correct commands to create the ACL were:

access-list testacl deny ip
access-list testacl permit every

...and to apply the ACL, I used the following:

interface vlan 5
ip access-group testacl

After the research I did, I felt confident to apply the ACL to the production switches, and the change worked flawlessly.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.