Solved: how to block traffic from one port to another wihin the same vlan ??

pinkheart · ‎11-05-2004

hello

I have cisco 3550 switch with SMI software , in one of the vlan there are 3 1300 AP each one connected to port , I want to block comunication between clients except with the server.

I block the comunication between the client from the same AP but, the client from AP 1 can connect to clients in AP2 and AP3 and vice versa

so I want to block that communication from the 3550 switch , so no client can connect to another one just with the 3 servers ( each AP and server has a seperate port )

note : all the AP and the server are in the same vlan and there are 3 vlan in the switch

please help

thanx in advance

mesuti · ‎11-07-2004

you can use Access-lists to do that ( MAC or IP )

but the ideal solution for this would be to configure Private VLANs within your VLAN, and configure clients as "isolated ports" and servers as "promiscous ports".

isolated ports are allowed to communicate just with promiscous and no other host even if they are in the same VLAN. There are also "community ports" which can communicate with promiscous hosts and with hosts that are in the same community, but I don't see any use of it in your case.

Best Regards

Mesut Abdurrahmani

View solution in original post

Prashanth Krishnappa · ‎11-05-2004

See if a VACL or a protected port suits your requirement

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12120ea2/3550scg/swacl.htm#wp1176911

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12111ea1/3550scg/swtrafc.htm#xtocid6

joyride_us · ‎11-06-2004

Hi, several ways to do it since you have a Layer3 switch:

1. place each client on its own VLAN and the server port on all VLAN's (intervlan routing)

2. more simple : access lists will do wonders for you

From my personal and humble experience, I do not like to change VLAN's on the switches as it sometimes bears consequences for other Dpt. of the company that I did not bother check before...but it is a more elegant solution that will give you more possibilities later on.

Goodluck!

Jef

mesuti · ‎11-07-2004

you can use Access-lists to do that ( MAC or IP )

but the ideal solution for this would be to configure Private VLANs within your VLAN, and configure clients as "isolated ports" and servers as "promiscous ports".

isolated ports are allowed to communicate just with promiscous and no other host even if they are in the same VLAN. There are also "community ports" which can communicate with promiscous hosts and with hosts that are in the same community, but I don't see any use of it in your case.

Best Regards

Mesut Abdurrahmani