Isolate devices within VLAN using ACL on Cisco SG350 switch

[william.shillpz]

Hi,

I have a router on a stick configuration. Pfsense acts as the main router and the SG350 Cisco switch on L2 mode. 

Everything works fine regarding the current configuration. The addition I want to do is to isolate all my guests coming from an Access Point in VLAN60. Meaning I don't want them to see each other at all. I'm trying to set up the proper ACL rule through the web-gui, when enabling it, all the hosts within VLAN60 are not able to obtain an IP address from the DHCP-server from Pfsense.

My guess is that I¨m either composing the rule wrong or my Wildcard mask is completely off cutting all the traffic.

The VLAN60 has a static IP of 192.168.60.1/24

The DHCP pool range used for VLAN60 is 192.168.60.10 - 192.168.60.50

I have added screenshots regarding the configuration made on the web-gui. I would appreciate your help figuring out what I'm doing wrong.

Thanks

[balaji.bandi]

If this switch acts as Layer2,  Pfsense acts as FW, and Layer 3, why not create an ACL rule on FW not to connect each other?

where is this P configured :

he VLAN60 has a static IP of 192.168.60.1/24

[william.shillpz]

Hi Balaji.bandi,

I was under the impression the ACL was to be done at the switch layer, as it controls the traffic within the same VLAN (60 in this case). I'm far from being an expert on networking, so maybe the right way is to do this at Pfsense. That would be a firewall rule I suppose?

The IP for VLAN60 = 192.168.60.1/24 is configured on Pfsense. As a VLAN on the LAN (physical interface)

[balaji.bandi]

as it controls the traffic within the same VLAN (60 in this case)

Apologies i was an impression different VLAN, so i suggested where Layer 3 was located.

If this Layer 2 filtering in the same VLAN, this can be done in switching itself.

Coming back to your config, are your source and destination the same IP address?

what is your goal ? you do not like any specific IP to contact to any other specific IP in the same range ?

example 192.168.60.10 to 192.168.60.100 (deny - rest allow ?)

I have somewhat fewer hands-on models:

check some configurations suggested :

https://www.cisco.com/c/en/us/support/switches/350-series-managed-switches/products-configuration-examples-list.html

[william.shillpz]

My goal is to have all the devices in VLAN 60 isolated from each other. They are already able to reach out to the Internet, which is the only thing they need. I don't want any devices within VLAN 60 to see any other device in the VLAN.

The source address is within the range of 192.168.60.10 - 192.168.60.100. I was trying to isolate them by denying this address space to communicate with each other (you can see my attempt in the first picture I attached in my first post), but then DHCP and probably DNS stopped working for all the devices in VLAN60. This was not what I intended.