A common scenario you might come across is having a device on your network that needs to be restricted. So for example a third party PC that doesn’t meet your security requirements but needs to access a production server.
If your network can support it then you would segment this part of your network with a VLAN then route between them on a layer 3 switch or at the router. So in my example its a layer 3 switch, write the access list then apply it at the VLAN interface either inbound or outbound.
Below is the basic config for VLAN 10, anything in this VLAN will only be able to access the production server at 10.50.5.10 which happens to be on VLAN 20, this would apply to devices or whole subnets on a different switch or even across the WAN. I’ll make this interesting and allow the clients only access on TCP port 80, and also allow the clients to lookup DNS on the same server this is UDP port 53.
Create your ACL
————————————-
ip access-list extended 100
permit ip any 192.168.1.0 0.0.0.255
permit tcp any host 10.50.5.10 eq www
permit udp any host 10.50.5.10 eq domain
deny ip any any log
Apply your ACL to the VLAN interface
————————————-
interface vlan 10
ip access-group 100 in
That’s all you have to do to restrict the traffic, its very simple the inbound and outbound commands are hard to understand at first but just imagine yourself standing on top of the switch and think of traffic direction, so in my case its inbound to the switch.
RH
all-things-networking 