05-04-2021 10:56 AM
entry TestACL { if match all {
source-address 192.168.1.0/24 ;
destination-address 192.168.170.0/24 ;
} then {
deny ;
} }
The customer configure this ACL on XOS, he ask me if is possible to replicate on XMC ?
Thanks
Giuseppe
Solved! Go to Solution.
05-11-2021 03:15 PM
Hi Giuseppe,
A policy using Policy feature in XMC could be done but it might be a bit of clicking depending on how many local VLANs you have. You could try to use an automated service for this (deny a resource which is a set of L3 locations and provide each subnet in the Resources). But such policy would have to be applied only to the router, as switches would cut off inside-VLAN communication even port-to-port. I don’t like point to myself but I think we can do a nice and concise ACL for the router and keep the Policy just for the access switches:
Hope that helps,
Tomasz
05-11-2021 03:15 PM
Hi Giuseppe,
A policy using Policy feature in XMC could be done but it might be a bit of clicking depending on how many local VLANs you have. You could try to use an automated service for this (deny a resource which is a set of L3 locations and provide each subnet in the Resources). But such policy would have to be applied only to the router, as switches would cut off inside-VLAN communication even port-to-port. I don’t like point to myself but I think we can do a nice and concise ACL for the router and keep the Policy just for the access switches:
Hope that helps,
Tomasz
05-08-2021 04:57 PM
Thanks for your reply
Is the routing device, I am looking for a policy to permit or deny the inter-vlan routing.
I will check the script.
Thanks
Giuseppe
05-06-2021 08:39 PM
Hi Giuseppe,
Is that the routing device or an access switch? If the latter, I’d consider using policy instead or move to the router for inter-VLAN routing restrictions if you don’t worry about unnecessary traffic reaching the router. If it’s your router, you could for example create a script in XMC that will execute following tasks on the switch:
Hope that helps,
Tomasz