Router on a Stick

zoro_2009zoro_2009 Posts: 26Member ■□□□□□□□□□
Hi,

I have a classique router on a stick configuration, and I want to implement some of the intervlan ACLs on the switch to take the load off the router.

I've configured an ACL on the SVI to prevent communication between the hosts on both vlans, but this doesn't seem to work !

The setup is: each host receiving an IP from the router (DHCP), and the subinterface is its gateway, The switch is L3, and there 2 SVIs !

Am I missing something here ?

Thanks

Comments

  • bharvey92bharvey92 Posts: 419Member
    Post the configurations up so we can have a look, just a punt - but could it be that you have not assigned the ACL to the correct interface?
    2018 Goal: CCIE Written [ ]
  • shortstop20shortstop20 Posts: 161Member ■■■□□□□□□□
    If the router is hosting the default gateway, you are not going to be able to apply ACLs on the SVIs of the switch to block traffic between VLANs. Those ACLs would need to be applied on the router subinterfaces.
    CCNA Security - 6/11/2018
    CCNP TShoot - 3/7/2018
    CCNP Route - 1/31/2018
    CCNP Switch - 12/10/2015
    CCNA R/S - 1/14/2015
  • james43026james43026 Posts: 303Member
    If the router is hosting the default gateway, you are not going to be able to apply ACLs on the SVIs of the switch to block traffic between VLANs. Those ACLs would need to be applied on the router subinterfaces.

    If you simply configured ACLs and applied them to a layer 3 interface / SVI on a switch, then it's not going to have an affect on traffic that isn't passing over the layer 3 SVIs. Which in your setup traffic has no need to interact with a layer 3 SVI directly on your switch since they are using your router as a default gateway. What you need are VACLs, which is simply a route map / access map as it would be called at a layer 2 level, that can reference an ACL to filter traffic at the VLAN level. This article may help you.
Sign In or Register to comment.