05-20-2010, 07:27 PM
This ACL is all wrong. First off in your original question you used the same network address for both departments. Then in your ACL you have two different networks. I will assume that the 192.168.3.0 subnet is for IT Dept and that the 192.168.5.0. Also the eq ICMP at the end of your ACL is only stopping pings and thats not even proper. So it looks like your super netting if its all under one big network. If those are the subnets and you want to block all traffic from reaching each other the ACL would look like this
deny ip 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255
deny ip 192.168.5.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip any any
How many routers are separating the two network segments?
deny ip 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255
deny ip 192.168.5.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip any any
How many routers are separating the two network segments?