Hello @Hank21 !

Thank you for your reply!

Below the link is a setting where one VLAN is disabled and the others are enabled.

I currently have 7 VLANs (a small community building with several smaller organizations), and sometimes this number changes. Usually everyone just wants to access the Internet, but sometimes it is necessary for someone to access another VLAN.

According to the solution below the link, I should write 6 prohibiting rules, which will make the ACL opaque.

Maybe my brain works the other way around, but I learned a long time ago that any "gateway" is safe if only what is explicitly allowed can pass through, and everything else is prohibited.

I gave the rules in this order:

1. G_VM1 -> G_ADminLan : Allow

2. G_VM1 -> G_OfficeLan : Allow

3. IPGROUP_ALL -> IPGROUP_ALL : Block

The problem is that 1. G_VM1 -> G_ADminLan works, but 2. G_VM1 -> G_OfficeLan does not work.

All you need to know is that the Vlan ID of G_AdminLan=1.

I would like to ask for help with this.

Regards, Sura

  @Tedd404 

I think that the 3rd rule applies to traffic between all VLANs, so if I put it in the 1st place, it does not check the rules that follow it.

I think the order 3 1 2 has the same result as if there were only rule number 3.

Maybe the ER7206 works differently?

It's a production system, so I can't try your tip.