RV220W: How to restrict Inter VLAN or DMZ traffic?

[gulliver_]

Hi,

just received my rv220w and perhaps I haven't got enough experience with cisco routers....

How can I restrict traffic between different VLANs?

For example: Hosts in one VLAN shall only be allowed to access a web server in another VLAN.

All other traffic should be blocked.

I've created two VLAN with Inter VLAN Routing enabled.

But it seems there's no way to install a firewall rule between VLANs.

Gulliver

[gulliver_]

Hi,

it seems like it isn't possible to define firewall rules between VLANs.

And also not between DMZ and LAN????

The configuation screen offers only firewall rules from LAN to WAN, from WAN to DMZ and from WAN to LAN.

Where can I define firewall rules from DMZ to LAN?

By now I must say I'm very confused by the poor documenation of the RV220W

Gulliver

[Te-Kai Liu]

The firewall rules of RV220W do not support filtering between VLAN

nor DMZ. We understand that this is a product limitation that can be improved over time.

[gulliver_]

Even an RVS4000 can do this job.

I'm once again very disappointed about the difference between Cisco's product specs and the the real capabilities of Cisco devices.

I'll return the router.

It'll be the last time I took Cisco products into account.

Bye

[gulliver_]

"We understand that this is a product limitation that can be improved over time."

Cisco products = Bananaware

...ripes at the the user

[viper5150]

Tekliu - I just purchased a RV220w as well and was disappointed to see that filtering between VLANs isn't available.  Is there any way you can reach out to the development team working on this product to see when it will be included?

[streaves]

Hi Viper -- Thanks for participating in the Support Community. I've discussed with the product team and we don't have a hard date for when this functioanlity will be available in the RV220W. Rather than hold you up, I recommend you take a look at the 800 Series Integrated Services Routers. I believe they'll have what you're looking for: http://www.cisco.com/en/US/products/hw/routers/ps380/index.html.

Thanks again for being a Cisco customer,

Stephanie Reaves

Cisco Small Business

[viper5150]

Thanks for the response Stephanie.  The 800 series is over the top overkill for what I'm looking for (not to mention downgrading from gigabit to fast ethernet).  So, follow up questions...

A.  The product team confirmed they are in fact working to add this functionality?

B.  I'm not exactly looking for a hard date on when this will be added.  I wasn't quite clear on that originally, my fault.  How about a rough estimate on when this can be expected?  Q3 2011?  Q4?

Thanks again for the product recommendation, but I believe I'm with the original poster here - if this isn't something that will happen with this router, I will likely look to another vendor as well.

[streaves]

Hey Viper -- Wish I had some concrete news for you. But I don't. I know the product team is evaluating the addition but I wouldn't say it's been confirmed. And I really can't commit to a date. Regrets.

Hope you'll take a look at the 800 Series but understand your predicament. Also hope you'll continue to participate in the community. It's a great resource for us as we develop new products and features. We do pay attention.

Thanks,

Stephanie Reaves

Cisco Small Business

[gulliver_]

Hi Stephanie,

fine, seems likes you studied poetry, not computer science.

Did you also write the passage:

Because all inter-VLAN settings are enabled by default, all inter-VLAN
routing works. However, disabling inter-VLAN routing per destination VLAN
does not block incoming traffic.
in the release notes?

I've tested it. The result in one sentence: Inter-VLAN routing cannot be diabled

I've another question for you. Why is Cisco lying?

Cisco writes in all its brochures about the RV220W it's SSl VPN is compatible to Windows 7 32 and 64 Bit.

Hello? Anybody at home at Cisco who tried to established a tunnel from an 64 Bit Windows?

The driver to be installed cannot be installed because it isn't certified.

When will Cisco correct it's brochures or better deliver a certified 64Bit driver????????????????????????

Netgear using exactly the same virtual passage driver has one. Perhaps you should call them.

P.S: Cisco seems to be a good example why the trade deficit of the U.S.is so huge.

With companies as dumb as Cisco they have to import almost everything that's more complex than a fridge,

except for one thing, weapons of mass destruction.

[viper5150]

I don't believe she studied poetry...  At least I don't believe anyone who did would recommend an 800 series router again after I clearly stated it was not the right fit for my environment.  Perhaps I didn't put it eloquently enough...

Interesting bug you found there, however.  I have setup VLAN's on my RV220w, but haven't put them all into service yet.  I'll let you know if I find anything different, although I expect I won't.

I did happen across another bug as well.  The "DHCP Leased Clients" doesn't report DHCP leases at all.  I have several machines pulling IP addresses from the RV220W, but still nothing there.  I'm running firmware version 1.0.1.0.

I was also able to duplicate the same result on the VPN client on a Windows 7 x64 system.  It's anybody's guess as to why they wouldn't use a globally trusted PKI cert to sign their driver.

Stephanie (or any Cisco employee for that matter) - What is the official channel for reporting bugs?

[kitus_san]

Oh dear, yet another disappointing finding!!!

[charlesandrewpaul]

Just wanted to add some more information...  I just purchased a SRP541W as a Cisco representative informed me that it would do very well for 3 seperate VLANs, 3 seperate SSIDs, and a single shared inter-vlan configuration for printing capability.  Of course, the representative was completely wrong. 

Guess what was recommended by Cisco support after 3 hours of troubleshooting this $500 product?  Downgrading to the RV220w!  Of course I read up on the model and find it gets horrible reviews, has some serious issues with DNS, and apparently cannot restrict VLAN or DMZ traffic in any way! 

With this poor result directly from the company, it is easy to see why there is sooooo much room for good products in the small business community.  Anyone having these crazy issues would be advised to look at purchasing A) WatchGuard Firebox series, or B) SonicWall TZ200 and up.  Both routers have better capabilities, and do not have to be rebooted manually every few weeks like the RV220w. 

Thanks Cisco -- I want my 3 hours and $500 back!