ACLs for segmentation

[BenSimanek]

Anybody have any good resources or examples of ACLs used for segmentation? I've created VLANs on my MS250, but now need to deny and allow traffic between certain VLANs. I've come across the documentation links, "Switch ACL Operation" and "Configuring ACLs", but still look for more examples.

[DarrenOC]

Hi @BenSimanek 

MS Best Practice, there's some information within:

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/...

[PhilipDAth]

Also not that MS L3 ACLs are stateless.  This can start making things tricky if you use them on multiple VLANs and want to do anything other than a layer 3 ACL.

[BenSimanek]

Thanks for the replies.

The Best Practices showed me how to combine the ACLs. However the final rule leaves out TCP traffic that was being deny above.

The stateless nature of the ALCs certainly makes them tricky. Also with a 128 limit, the inability to use a port range or list of subnets, the ALC only seems appropriate for denying all traffic between VLAN.

Thanks for the help.