ACL for applying over VLAN

[Alok_Shukla]

We have 4 VLAN over Core Switch (MLAG configured)
VLAN 1: 10.3.1.0
VLAN 2: 10.3.2.0
VLAN 3: 10.3.3.0
VLAN 4: 10.3.4.0

we don't want VLAN-3 and VLAN-2 to communicate with VLAN-1.
But VLAN-2 and VLAN-3 should communicate each other.
Help to apply me what ACL should be applying?

[Aman]

Hi alok,

You can deny the traffic for VLAN 1 from VLAN 2 & VLAN 3.

entry Vlan_2 {
if match all {
source-address 10.3.2.0/24;
Destination-Address 10.3.1.0/24;
}
then {
count Corp_Vlan_2 ;
deny ;
}
}
entry Vlan_3 {
if match all {
source-address 10.3.3.0/24;
Destination-Address 10.3.1.0/24;
}
then {
count Corp_Vlan_Traffic2 ;
deny ;
}

[Alok_Shukla]

Thanks Aman
this ACL is applied on ingress direction

[Mel78__CISSP__E]

The most straightforward way to do is using VRF.