L3 Switch Vlan complete isolation

[QUARK TARO]

I have a L3 switch used with three vlans. I need to ensure that traffic from each valn including broadcast, multicast should not cross each other. My objective is all three vlans should be 100% isolated. Traffic from one vlan should never enter another vlan. How do I ensure this?

[paul driver]

Hello

You can use PVLANS but RACL's would be applicable here also.

ip access-list extended no-vlan20-30
deny ip any 20.20.20.0 0.0.0.255
deny ip any 30.20.20.0 0.0.0.255

permit ip any any

int vlan 10
ip access-group no-vlan20-30 IN

ip access-list extended no-vlan10-30
deny ip any 10.10.10.0 0.0.0.255
deny ip any 30.20.20.0 0.0.0.255

permit ip any any

int vlan 20
ip access-group no-vlan10-30 IN

ip access-list extended no-vlan10-20
deny ip any 10.10.10.0 0.0.0.255
deny ip any 20.20.20.0 0.0.0.255

permit ip any any

int vlan 30
ip access-group no-vlan10-20 IN

res
Paul

[QUARK TARO]

I have a question in mind, if I do not define any IP interface on vlan, is there any possibility of any type of traffic (broadcast, multicast) reaching from one vlan to another vlan?

[paul driver · Accepted solution]

Hello

not from the negated vlans but within each vlan yes there is - but you can minimise this through storm control 

res

paul

[QUARK TARO]

Can I define acl in the following way?
ip access-list extended no-vlan20-30
permit ip 30.20.20.0 0.0.0.255 any
deny ip any any

[paul driver]

Hello

you cn but that will negate all communication to everything outside that vlan even other vlans  and wan traffic 

res

paul