CISCO ACL Question

[blastxp]

can someone suggest me an ACL solution to stop Branch Office VLAN 1 Accessing Head office VLAN 20.

Head office VLAN 20 should not have HO VLAN 1 access or branch office access

Please check both router configs posted here



Head Office Router

interface Tunnel0
ip address 192.168.254.253 255.255.255.252
tunnel source Vlan10
tunnel destination X.X.X.X
!
interface FastEthernet2
description Internet_WAN
switchport access vlan 10
!
interface FastEthernet3
switchport access vlan 20
!
interface Vlan1
description Local LAN
ip address 10.0.0.138 255.255.255.0
ip nat inside

interface Vlan10 (WAN Interface)
ip address X.X.X.X 255.255.255.252
ip nat outside

interface Vlan20
description Sales_Interface
ip address 192.168.0.254 255.255.255.0
ip nat inside
!
router ospf 1
passive-interface default
no passive-interface Tunnel0
no passive-interface Vlan1
network 10.0.0.0 0.255.255.255 area 0
network 192.168.0.0 0.0.255.255 area 0
!
ip nat inside source list 1 interface Vlan10 overload

ip nat inside source static tcp 10.0.0.33 8001 interface Vlan10 8001
ip nat inside source static tcp 192.168.0.229 1234 interface Vlan10 1234
ip nat inside source static udp 192.168.0.229 1234 interface Vlan10 1234

ip route 0.0.0.0 0.0.0.0 X.X.X.X (VLAN 10)
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.255.255



Branch Office ROuter

interface Tunnel0
ip address 192.168.254.254 255.255.255.252
tunnel source Dialer0
tunnel destination X.X.X.X (Head Office WAN)
tunnel protection ipsec profile protect-gre
!
interface Vlan1
description Local LAN
ip address 192.168.0.249 255.255.255.0
ip nat inside

!
interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
ip nat outside
!
router ospf 1
passive-interface default
no passive-interface Tunnel0
no passive-interface Vlan1
network 10.0.0.0 0.255.255.255 area 0
network 192.168.0.0 0.0.255.255 area 0

!
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 192.168.0.10 8001 interface Dialer0 8001
ip route 0.0.0.0 0.0.0.0 Dialer0

access-list 1 remark INSIDE_IF=Vlan1
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.255.255

Many Thanks