Anyway to isolate VLAN on Cisco layer-2 switches.

[Mahmoud Marie]

Hello,

Anyway to isolate VLAN on Cisco layer-2 switches. like ARUBA VLAN segmentation feature.

As we need to isolate OT VLAN.

Thanks

[M02@rt37]

Hello @Mahmoud Marie,

Yes, you can isolate VLANs on Cisco layer-2 switches using various methods. One common approach is to use Private VLANs (PVLANs), which provide VLAN segmentation and isolation similar to ARUBA VLAN segmentation feature.

Private VLANs allow you to divide a single VLAN into multiple isolated sub-VLANs, known as secondary VLANs. These secondary VLANs can communicate only with the primary VLAN (also known as the promiscuous VLAN) but are isolated from each other. This provides a secure way to isolate devices within the same VLAN.

Private VLANs are supported on some specific Cisco switch models and might require specific licensing. Be sure to check the documentation for your switch model and software version to ensure compatibility and availability of this feature.

If your specific Cisco switch model does not support Private VLANs, there are other methods for isolating VLANs, such as using ACLs to control inter-VLAN communication, or using VRF instances for L3 segmentation. However, these methods are more suitable for L3 switches or routers.

Pvlan on Cisco Catalyst:

https://www.cisco.com/c/en/us/support/docs/lan-switching/private-vlans-pvlans-promiscuous-isolated-community/40781-194.html

[Kasun Bandara]

@Mahmoud Marie hi,yes. you can use cisco Private VLANs.  check below link for guide

https://packetlife.net/blog/2010/aug/30/basic-private-vlan-configuration/

[Mahmoud Marie]

Hello,

The switches support PVLAN, Just need to know which interface should I create the promiscuous port, here the our network design, just need to isolate OT VLAN.

Thanks

[paul driver]

Hello
Can you elaborate on what you are wanting to accomplish?

If you want to isolate hosts from a single vlan from hosts in other vlans within your network then you could apply a VRF or RACL to the L3 SVI of that particular vlan to negate inter-vlan communication.

If you wish to isolate or control various hosts from communicating with each other at a layer 2 perspective within certain vlan(s) then using PVLANs could accomplish this.

[Mahmoud Marie]

Hello Paul,

Yes I want to isolate OT-VLAN to communicating to any other VLAN, so I will configure PVLAN and need to know which interface should I create the promiscuous port or it not necessary to create promiscuous port as I only need to isolate Layer-2 traffic.

Thanks

Thanks