Block Host to Host Communications on a sub-interface

[shax77]

We have our guest network on a sub-interface and are discussing a method of preventing communications between hosts on the guest network.  Is it possible to create an access rule in that sub-interface to accomplish this?

[Seb Rupik · Accepted solution]

Hi there,

Communication between hosts connected to the same sub-interface will be done at Layer2, no traffic will hit the firewall and therefore it cannot be blocked.

To prevent this communication you should configure protected ports on the access layer where this VLAN is used.

cheers,

Seb

[shax77]

Thanks for clarifying my thinking. I will pursue the options suggested here!

[Hamdi Kadri]

You can't configure this on you Firewall, instead you may think of PVLANs as a better solution on your access Switch.
Check this: https://learningnetwork.cisco.com/docs/DOC-16110