S Series Inbound Port Policy Deny Subnet

[Walt_Witkowski]

We are routing multiple networks with S-Series routers.  Multiple networks inbound on a trunk port from closet switches.  At one point we set policies on the closet switch ports to deny destination ip range access.  EX.  Student Vlan defined port was manually assigned a policy to deny access to certain ip ranges (Employee vlans).  This can be troublesome because of the amount of moves and changes that take place in our environment at the closet level. We would like to do something similar on the S-Series core inbound trunk ports but by vlan definition?    But in this case its a trunk port so we want to deny the student subnet access to the employee range but not all traffic.   .

[Zdeněk_Pala]

On S-series you should be able to use source IP mapping to Policy Role:

Then in rules you can define your actions…

Z.