A conceptual question on VLANs

[yosefshai]

Hi All,

I have a conceptual question on VLANs please.

Assume I have in my company 2 departments (Finance and HR), all computers attached to the same L2 switch but separated by 2 different VLANs (V100 and V200).

On a different network I have 2 servers (the HR server which is @ 192.168.10.10 and the Finance sever which is @ 192.168.10.20).

All traffic from the Finance and HR departments towards the 192.168.10.X pass through a Cisco router that is connected to all networks with different legs.

Now, what should I do (on the router) in order to avoid HR computers from accessing the Finance (and vice versa)?

1. Should I apply IP ACLs on the router? if so then how do the VLANs helped me in here (if using IP ACLs).

2. Is there a different way to achieve my goal please?

TIA

Shai

[Martin Carr]

Correct, you need to create an ACL on the router and apply it to the respective sub interface.

Martin

[yosefshai]

Well, then how do the VLANs come in handy if IP ACLs are needed in here?

What benefits do the VLANs provide me with please?

[Martin Carr]

A VLAN is a broadcast domain, you use them to create logical networks. To communicate between them you need to route.

By default all networks will be reachable, hence why you need an ACL to restrict access.

Martin

[chinpohpang851]

I thought Layer 2 switches mean plug n play and only Layer 3 switches are managed switch?

[Henrik Grankvist]

Nope. A layer 2 switch is a switch that only forwards based on the layer 2 address (MAC address), and a layer 3 switch can also forward based on the layer 3 address (IP address).

[chinpohpang851]

Thanks! I've learnt something.

[Henrik Grankvist · Accepted solution]

Hi

VLANs are only effective at layer 2, and the router operates at layer 3. So the VLANs are there to seperate the traffic at layer 2, but you need to apply ACLs on the router to still keep the traffic seperated at layer 3.

[paul driver]

Hell0

I am assuming the router/L3 switch is doing the inter vlan routing for these vlans so your are correct a RACL would be applicable?

Can you post the config for this device to confirm your existing configuration

res

Paul