topic Block Host to Host Communications on a sub-interface in Network Security

Block Host to Host Communications on a sub-interface

shax77 — Fri, 21 Feb 2020 14:40:37 GMT

We have our guest network on a sub-interface and are discussing a method of preventing communications between hosts on the guest network. Is it possible to create an access rule in that sub-interface to accomplish this?

Re: Block Host to Host Communications on a sub-interface

Seb Rupik — Wed, 08 Nov 2017 16:34:55 GMT

Hi there,

Communication between hosts connected to the same sub-interface will be done at Layer2, no traffic will hit the firewall and therefore it cannot be blocked.

To prevent this communication you should configure protected ports on the access layer where this VLAN is used.

cheers,

Seb

Re: Block Host to Host Communications on a sub-interface

Hamdi Kadri — Thu, 09 Nov 2017 11:29:04 GMT

You can't configure this on you Firewall, instead you may think of PVLANs as a better solution on your access Switch.
Check this: https://learningnetwork.cisco.com/docs/DOC-16110

Re: Block Host to Host Communications on a sub-interface

shax77 — Thu, 09 Nov 2017 14:29:35 GMT

Thanks for clarifying my thinking. I will pursue the options suggested here!