Fully Isolated VLAN

[Arashai]

Hi all, first time poster, long time lurker.

I have two vlans on a L3 switch (2960-XR w/IP Lite), one (vlan 10 - SVI: 10.1.1.250/24) that needs to be able to connect to others via EIGRP over VPLS, and one (vlan 20 - SVI: 10.2.2.250/24) that needs to be fully isolated because the IP range used is duplicated on the other switches as well and could cause duplicate IP issues.  Here is what I've tried:

1. No IP on isolated SVI: This effectively prevents the subnet from showing in the routing table, but the software guys want to be able to ping the "gateway"to verify connectivity.
2. Use loopback with ip 10.2.2.250 instead: Tested, but am unable to ping loopback from vlan 20 access port.
3. VRF: 2960 does not support vrf =(
4. Put a deny any any access list in place: prevents L3 traffic, but subnet still appears in routing table.  Also, see 5. 
5. Simply don't advertise that subnet: the nature of the infrastructure requires a layer 2 trunk to the VPLS using SVIs rather than just having a 'no switchport' routed interface.  I'm a little paranoid that vlan 20 will leak out somehow, even if the trunk only allows vlan 10.  

Thanks in advance for your time.

~Chris

[Jon Marshall · Accepted solution]

Without VRF support you are going to have to just make sure EIGRP does not advertise the subnet. 

Or instead of having SVI have a host with the SVI IP the developers could use to test connectivity as they are not routing out of the vlan anyway. 

Perhaps someone else may be able to suggest something. 

Jon

[Arashai]

Thanks for the suggestion, Jon. I will take this path, as they do have a server on vlan 20 they can use to test.

[Georg Pauwen]

Hello,

just to clarify what you are trying to accomplish: the Vlan should not be reachable from anywhere including from the same switch ?

[Arashai]

Hi Georg,

Correct. Ideally, I'd like to see vlan 20 not be reachable from even other interfaces in the same switch. No traffic in or out.

[Georg Pauwen]

Hello,

so you have tried:

access-list 101 deny ip any any

interface Vlan20
ip access-group 101 in
ip access-group 101 out

What is the problem with the route still appearing in the routing table ? In order from EIGRP to send/receive it, you could use a distribute list. Is that an option ?

[Arashai]

Hi Georg,

Yes, I have considered that approach.

My concern is that there are dozens of other L3 switches in the network all carrying the same IP range and I'm trying to mitigate the risk of duplicate IPs being propagated throughout. I know that using a distribute list or just not advertising that network would potentially solve that problem, but I was hoping that a cleaner and perhaps more robust solution could be found.

~Chris

[iashaan55]

Hello,

Where is the software guys located? In VLAN 20 or elsewhere?

Ashaan

[Arashai]

Hi Ashaan,

Yes, their equipment is located within vlan 20.

~Chris