topic access list on a vlan interface wont work! in Switches, Hubs, and Modems

access list on a vlan interface wont work!

dmsman — Thu, 23 Sep 2021 15:38:03 GMT

I have a core switch "HP 8206" connected through vlan 2 to an isp router which in turn connects me to my branch on subnet 192.168.2.1/24 through an isp router, im trying to control my vlan 1 traffic 192.168.1.1/24 to vlan 2 through an access list on the vlan 1 interface but it simply isn't working even after trying ip access-group acl in,out,vlan please help

ip access-group extended test
Deny ip 192.168.1.25 255.255.255.255 192.168.2.7 255.255.255.255
Permit ip any any

vlan 1
name "Server-VLAN"
untagged Trk45
ip address 192.168.1.1 255.255.255.0

ip access-group test in

vrrp vrid 1
virtual-ip-address 192.168.1.1
priority 255
enable
exit

Re: access list on a vlan interface wont work!

Ivan_B — Wed, 22 Sep 2021 05:51:19 GMT

Hi @dmsman !

This ACL should deny traffic sourced from single IP 192.168.1.25 to single IP 192.168.2.7, the rest is allowed. Is it really what you need to achieve? Just block IP traffic between those two single IP addresses?

Re: access list on a vlan interface wont work!

dmsman — Wed, 22 Sep 2021 07:43:39 GMT

no this isn't the full acl this is just an example , the thing is the traffic is stil going as the acl isnt there

Re: access list on a vlan interface wont work!

Ivan_B — Wed, 22 Sep 2021 11:26:59 GMT

You need to be sure your hosts in Vlan 1 are using 192.168.1.1 as default gateway.

Another issue, sorry, I've overlooked it - you are using subnet masks in the ACL while you must use wildcard masks instead:

ip access-group extended test Deny ip 192.168.1.25 0.0.0.0 192.168.2.7 0.0.0.0 Permit ip any any

Thus, if you want to block the whole subnet and the subnet has /24 mask (255.255.255.0), then the correct wildcard mask will be 0.0.0.255

Re: access list on a vlan interface wont work!

dmsman — Sun, 26 Sep 2021 06:01:34 GMT

-please is there a way to find hits on the access list on the vlan when i use access-group in or out? i could only find hits using show statistics aclv4 vlan x vlan

-what is the difference between access-group in/out/vlan?