Separating networks

[beverhart]

Hi, im working on a simulated project that has a building with 5 floors and 5 different departments. All departments must not be able to access each others networks. All departments share floors and access switches with other departments. I have uploaded an image of the drawing I have setup so far. I have it in packet tracer and have everything talking and everything seperated in respective vlans and subnets. But the problem is that everything can talk to everything because of routing. What would be the best way to separate everyone? ACLs? Im pretty new at this so any help would be appreciated

Regards

[balaji.bandi · Accepted solution]

You do VLAN ACL or ACL to stop comminication between the VLAN IP address.

access-list 100 deny ip 128.38.10.0 0.0.0.255 128.38.20.0 0.0.0.255

access-list 100 deny ip 128.38.10.0 0.0.0.255 128.38.30.0 0.0.0.255

access-list 100 deny ip 128.38.10.0 0.0.0.255 128.38.40.0 0.0.0.255

access-list 100 deny ip 128.38.10.0 0.0.0.255 128.38.50.0 0.0.0.255

access-list 100 deny ip 128.38.10.0 0.0.0.255 x.x.x.x 0.0.0.255
access-list 100  permit ip any any

Interface vlan 10
ip access-group 100 in

[beverhart]

Thank you very much!!

[Georg Pauwen]

Hello,

private Vlans would be an option. Packet Tracer does not support VACLs or private Vlans, so that is not really a good tool for testing. What physical hardware does your network consist of ?

[Joseph W. Doherty]

Another option, for your L3 routing, is using VRF (sort of the L3 version of VLANs).