qos policy control vlan traffic

[hibym]

Hi everyone,
I have a problem with configuring qos policies to control traffic between vlans.

on example in my scenario:
vlan110 (admin) should have access to all other vlans. VLAN104 is my guest vlan. I can easliy allow traffic from vlan110->any.
But.. If I am dropping the traffic from vlan104->vlan110, I cannot ping the host in vlan104 because the replys were dropped by the switch.

I dont want to create for every service a allow-policy in both directions.
What is the easiest way to configure this on the switch?

Best and thanks!
Alex

[silvio]

Hi,
this is possible - but don't forgett: the switch isn't a stateful firewall. So you have to confifigure policies for every direction.
Your wish is possible with the "policy condition established". When an initial TCP connection packet is received only the syn flag is set. As a result, TCP packets are only examined if they are not the starting packet. So you can use it to forbit the first answer packet of a tcp session - and so it is not possible to establisch a tcp session in one direction. For more infos look into the cli guide.

regards
Silvio