Isolate Clients On Same VLAN

[Erik_R]

Hello. I created an "Internet only" VLAN on an MS switch. I have an ACL in place that prevents this VLAN from accessing all of my other production VLANs. This "Internet only" VLAN will be for some guests that will be wired clients for several weeks.

Is there any way to isolate these clients from each other? In other words, these guest users should only be able to connect to the Internet and not connect to each other.

Would it be possible to create an ACL to block the "Internet only" VLAN from itself?

[bberry]

I always thought ACLs were only processed for traffic entering / leaving the interface where they are applied. Anything on the same wire / same VLAN would not pass through the ACL.

Brent

[mloraditch]

https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Restricting_Traffic_with_Isolated_Switch_Ports

This should do what you want.

[aleabrahao]

Personally, I think this option is much more work, since the configuration is per port.

I don't see much point in what it intends to do, a simple ACL is much more practical.

[mloraditch]

I mean he said he wants every port in the vlan, so just filter that in switch port view, leave out the uplink port and edit. Should take a few moments.

ACLs are also global to all switches in the network and could have unintended consequences, this would only affect the ports in question. 🤷‍

[aleabrahao]

I agree, but in this case it is only blocking communication between the same subnet, it should not have a major impact. 😉

[aleabrahao · Accepted solution]

I know it's not possible in MX, but I believe it is possible in MS.

Theoretically, it's enough to create an ACL blocking everything for the network as Source and also as Destination.

Have you tried this?

[Karsten Iwen]

This is what TrustSec with SGTs is designed to do. But there are some more requirements for that.

[Erik_R]

An update regarding this.

An ACL blocking the "Internet Only" VLAN from itself worked. Enabling port isolation on each port worked as well.

However, none of these settings will work if a switch (obviously non-Meraki) is connected to one of these ports as an uplink on a Meraki switch and clients are connected to it. The clients will be able to ping each other because that traffic is not flowing through the Meraki switch port.

[aleabrahao]

Exactly, because this communication does not need to go to the network gateway, that is, it is communication within L2.

But do you see ping as a problem?

[Erik_R]

Well, these are guests "squatting" in our office from different trades. Ideally I would prefer that none of their machines can contact each other on the same VLAN. I don't have enough ports to properly patch them into our Meraki switches.

[aleabrahao]

In this case there is not much to do other than replace them with Meraki switches. 😕

[joey.debra]

Normally ACL's on MS switches are VLAN ACL's so you should be able to just block traffic coming from that VLAN to any private RFC1918 address in 3 rules and that should effectively also isolate guest clients from each other.