Cisco Systems 3750E manual Denying Access to a Server on Anothera Vlan, 34-35

Chapter 34 Configuring Network Security with ACLs

Configuring VLAN Maps

Figure 34-4 Wiring Closet Configuration

	Switch B
Switch A	Switch C

VLAN map: Deny HTTP
from X to Y.
HTTP is dropped
at entry point.
Host X	Host Y
10.1.1.32	10.1.1.34
VLAN 1
VLAN 2
Packet

101355

If you do not want HTTP traffic switched from Host X to Host Y, you can configure a VLAN map on Switch A to drop all HTTP traffic from Host X (IP address 10.1.1.32) to Host Y (IP address 10.1.1.34) at Switch A and not bridge it to Switch B.

First, define the IP access list http that permits (matches) any TCP traffic on the HTTP port.

Switch(config)# ip access-list extended http

Switch(config-ext-nacl)#permit tcp host 10.1.1.32 host 10.1.1.34 eq www

Switch(config-ext-nacl)# exit

Next, create VLAN access map map2 so that traffic that matches the http access list is dropped and all other IP traffic is forwarded.

Switch(config)# vlan access-map map2 10

Switch(config-access-map)# match ip address http

Switch(config-access-map)# action drop

Switch(config-access-map)# exit

Switch(config)# ip access-list extended match_all

Switch(config-ext-nacl)# permit ip any any

Switch(config-ext-nacl)# exit

Switch(config)# vlan access-map map2 20

Switch(config-access-map)# match ip address match_all

Switch(config-access-map)# action forward

Then, apply VLAN access map map2 to VLAN 1.

Switch(config)# vlan filter map2 vlan 1

Denying Access to a Server on Anothera VLAN

You can restrict access to a server on another VLAN. For example, server 10.1.1.100 in VLAN 10 needs to have access denied to these hosts (see Figure 34-5):

•Hosts in subnet 10.1.2.0/8 in VLAN 20 should not have access.

•Hosts 10.1.1.4 and 10.1.1.8 in VLAN 10 should not have access.

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		34-35