How to prevent communication between 2 subnets in Same VRF.

[capgemini-network]

Hello,

I have as much as 90 subnets in a single VRF (each subnet is assigned to a building). From security point of view, I don't want my one building subnet to talk to another building subnet, even though they are part of same VRF. ACL is one of the option but not practical with soo many Subnets.

Please suggest if there is some way to control the communication between 2 subnets in Same VRF.

[Jon Marshall]

If you don't want them to talk to each other then why are they in the same VRF ? 

If they have to be then you have to use access-lists practical or otherwise. 

Jon

[capgemini-network]

Because they all are part of same service. Lets call it a Home CCTV service, I don't want them to see each other due to security concerns.

[Seb Rupik]

As @Jon Marshall mentions an ACL is your best option. Assuming you have allocated your building subnets with aggregation in mind, so in contiguous blocks, you should be able to create very brief ACLs with sufficiently large netmasks to cover the entire building.

cheers,

Seb.

[capgemini-network]

That might be little difficult to use large subnet mask.

Example I have 10.74.1.0 - 10.74.150.0 - i.e. 150 /24 subnets in 150 buildings. I may have to deny all /24 subnets for each building.

[dbeattie]

Try thinking about what you want to allow rather than what you want to prohibit. That may end up as a simpler ACL.

Hope this helps

Dave

[paul driver]

Hello

---

@capgemini-network wrote:

Hello,

I don't want my one building subnet to talk to another building subnet

---

You don't have to apply the Racl to every subnet. at most your looking at two (assuming each subnet equates an svi or sub-interface)

[dbeattie]

I would tend to create a single ACL:

permit any to server subnet(s)

deny any

and apply it to all access vlan SVIs. You may need a few more addresses in the ACL, but I hope you get the idea.

That means you only have to maintain one ACL.

Hope this helps

Dave

[Joseph W. Doherty]

In addition to what the other posters have already mentioned, another possible approach might be to partition your network using routing protocol(s), i.e. you would determine what you redistribute between routing topologies. (One advantage of VRF, you can keep topologies separate on the same router, i.e. they don't automatically go into the same global routing table on that device.)