Protecting access layer using private vlan

[crusier2015]

Hi,

I´m planning implement private vlan for all switches on network, 15 switches on all network ( there are 15 floors separetd by vlan 1-15). The purpose is block the hosts communicate each other on same network. I dont have ISE to implemment the best way , but in your opnion implement private vlan on access layer could bring some problems on performance or others kind of problems?

Tks

[Reza Sharifi]

Hi,

Why do you want to block hosts from communication with each other? If you want to block subnets/vlans from communicating with each other, instead of private vlan, you can use access list on the core switch where routing takes place. Don't make things complicated if you don't need to and don't have a requirement. 

HTH

[crusier2015]

Hi thanks for comment, i want block the communication for hosts on the same network, for security purposes, creating a layer 2 defense.

[Reza Sharifi]

In that case, you can start with these documents.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vacl.html

https://www.cisco.com/c/en/us/td/docs/wireless/asr_901/Configuration/Guide/b_asr901-scg/b_asr901-scg_chapter_0111000.pdf

HTH

[crusier2015]

Tks, i will plain to use VACL too, in your opinion or others freinds of forum, if i use Private VLAN on all access switches, could generate any impact, for example low perfomance, caused by hardware resourses cosumed on the switches 2960S?

TKS

[Reza Sharifi · Accepted solution]

No, I don't think that configuring private vlans will cause any performance issues. Overall, I think the port ACL config maybe an easier solution. 

HTH

[crusier2015]

Tks, i checked on Cisco search tool,  and unfortunately the switches model WS-C2960S-48LPS-L,  VACL,PACL and PRIVATE VLANs dont work, only work PRIVATE VLAN Edge.

[paul driver]

Hello

---

@crusier2015 wrote:

´m planning implement private vlan for all switches on network, 15 switches on all network 

---

---

@crusier2015 wrote:

Tks, i checked on Cisco search tool,  and unfortunately the switches model WS-C2960S-48LPS-L,  VACL,PACL and PRIVATE VLANs dont work, only work PRIVATE VLAN Edge.

---

If you would want to negate communication between specific vlans in your network then as have multiple switches and assume vlans also then you need to apply routed access-lists on the L3 interfaces for these vlans and this is done on the device performing that routing not on the switches.

[crusier2015]

Tks Paul, in this case i have to deny communication between hosts in the same network. tks

[paul driver · Accepted solution]

Hello

---

@crusier2015 wrote:

Tks Paul, in this case i have to deny communication between hosts in the same network. tks

Tks, i checked on Cisco search tool, and unfortunately the switches model WS-C2960S-48LPS-L, VACL,PACL and PRIVATE VLANs dont work, only work PRIVATE VLAN Edge.

---

Then you quite limited, however a crude way for L2 protection would be use a protected port on each access-port you wish not to communicate with another protected port butt this only works between ports that this feature is applied to.

int x/x
description access port
switchport protected

[crusier2015]

Hi Reza and Paul, 

Sorry for the late, tks for your help.