topic Client Isolation in Endpoint Security

Client Isolation

Izac ICT — Fri, 14 May 2021 10:39:07 GMT

Dear all,

Could you please advise me client isolation examples in catalyst switch?

Can I achieve it with vlan access map for example first 50 IPs are servers and rest are client machines?

Maybe better ways?

Please advise me some examples.

Thank you.

Isac

Re: Client Isolation

Rob Ingram — Fri, 14 May 2021 11:46:49 GMT

@Izac ICT

It depends on what exact hardware you have, but yes you could use a VLAN ACL (VACL) or alternatively you could use TrustSec. Typically TrustSec is deployed and managed via ISE, but you can configure locally on the switch without using ISE.

Re: Client Isolation

Izac ICT — Fri, 14 May 2021 13:39:22 GMT

Hello @Rob Ingram

Do you have any trustsec examples to guide me or any links?

THank you.

Isac

Re: Client Isolation

Rob Ingram — Fri, 14 May 2021 13:50:30 GMT

@Izac ICT

https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/sgacl_config.html

https://community.cisco.com/t5/security-documents/trustsec-troubleshooting-guide/ta-p/3647576

Re: Client Isolation

Izac ICT — Mon, 17 May 2021 12:59:52 GMT

I've read them but they are too general. What I need is in 192.168.33.0/24 subnet, allow access to server IPs 192.168.33.1-70 and block rest (192.168.33.71-255) to talk each other in VLAN33. Of course it would be great to allow access to fileserver on only SMB port etc.

Can it be achieved with trustsec, any example?

I'm sorry for asking example because I worked mostly on routing in Cisco and security on Juniper only.

Re: Client Isolation

Rob Ingram — Mon, 17 May 2021 14:03:55 GMT

@Izac ICT Other than the cisco guides there isn't much information for a manual implementation of trustec (short of writing it myself), most examples are for management via ISE. Perhaps use a VACL, in which case here is an example:-

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/security/503_u2_2/b_Cisco_n3k_security_cg_503_u2_2_chapter_01001.html

https://ciscoskills.net/2017/11/20/vlan-access-lists-vacls/