From: Adam Crisp (adam.crisp@totalise.co.uk)
Date: Thu Nov 07 2002 - 12:24:22 GMT-3
Hi,
I think I've found a bug on the 3550, but can't find any reference to it on
CCO.
Vlan 254 on my switch supports IP hosts on the subnet 192.168.200.0 /24
I am trying to prevent access on the switch, to a PC with IP address
192.168.200.2
This PC is plugged int Fast 0/2.
According to the documentation, you can use an ip access-lists to do the
above requirement.
hence:
!
access-list 1 deny 192.168.200.2
access-list 1 permit any
!
interface FastEthernet 0/2
switchport access vlan 254
switchport mode access
no ip address
ip access-group 1 in
spanning-tree portfast
!
This works ok.
The problem is, is that the above configuration, not only blocks access to
port fast0/2, - but to any other port on the switch
If I move my PC from 0/2 to 0/6 and 0/6 is configured like:
!
interface FastEthernet0/6
switchport access vlan 254
switchport mode access
no ip address
spanning-tree portfast
!
then the PC still cannot access the switch. If I remove the "ip access-group
1 in" command from fast 0/2 - everything is ok.
I am using the following ios release
"Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I5Q3L2-M), Version 12.1(11)EA1, "
This is the L3 feature set.
Anybody come across this?
Adam
This archive was generated by hypermail 2.1.4 : Tue Dec 03 2002 - 07:22:54 GMT-3