Reply to thread

Message: <blockquote data-quote="blastxp" data-source="post: 21333550" data-attributes="member: 39270">can someone suggest me an ACL solution to stop Branch Office VLAN 1 Accessing Head office VLAN 20. Head office VLAN 20 should not have  HO VLAN 1 access or branch office access Please check both router configs  posted here Head Office Router interface Tunnel0 ip address 192.168.254.253 255.255.255.252 tunnel source Vlan10 tunnel destination X.X.X.X!interface FastEthernet2 description Internet_WAN switchport access vlan 10!interface FastEthernet3 switchport access vlan 20!interface Vlan1 description Local LAN ip address 10.0.0.138 255.255.255.0 ip nat insideinterface Vlan10  (WAN Interface) ip address X.X.X.X 255.255.255.252 ip nat outsideinterface Vlan20 description Sales_Interface ip address 192.168.0.254 255.255.255.0 ip nat inside!router ospf 1 passive-interface default no passive-interface Tunnel0 no passive-interface Vlan1 network 10.0.0.0 0.255.255.255 area 0 network 192.168.0.0 0.0.255.255 area 0!ip nat inside source list 1 interface Vlan10 overloadip nat inside source static tcp 10.0.0.33 8001 interface Vlan10 8001ip nat inside source static tcp 192.168.0.229 1234 interface Vlan10 1234ip nat inside source static udp 192.168.0.229 1234 interface Vlan10 1234ip route 0.0.0.0 0.0.0.0 X.X.X.X (VLAN 10)!access-list 1 remark INSIDE_IF=Vlan1access-list 1 permit 10.0.0.0 0.0.0.255access-list 1 permit 192.168.0.0 0.0.255.255Branch Office  ROuterinterface Tunnel0 ip address 192.168.254.254 255.255.255.252 tunnel source Dialer0 tunnel destination X.X.X.X (Head Office WAN) tunnel protection ipsec profile protect-gre!interface Vlan1 description Local LAN  ip address 192.168.0.249 255.255.255.0 ip nat inside!interface Dialer0 description $FW_OUTSIDE$ ip address negotiated ip nat outside !router ospf 1 passive-interface default no passive-interface Tunnel0 no passive-interface Vlan1 network 10.0.0.0 0.255.255.255 area 0 network 192.168.0.0 0.0.255.255 area 0!ip nat inside source list 1 interface Dialer0 overloadip nat inside source static tcp 192.168.0.10 8001 interface Dialer0 8001ip route 0.0.0.0 0.0.0.0 Dialer0access-list 1 remark INSIDE_IF=Vlan1access-list 1 permit 10.0.0.0 0.0.0.255access-list 1 permit 192.168.0.0 0.0.255.255Many Thanks</blockquote>

Verification: Hath warak paha keeyada? (hatha wadikireema paha)

Top Bottom