Router VLAN isolation

[locus2007]

Hi,

I am fighting with problem isolating Vlans. It is 876 router and the idea is one connection to internet using Router ADSL WAN with Vlans I add Vlan2 to FE1 and Dynamic nat, DHCP for VLAN2 only and it works but  I cant make ACL to isolate VLAN1 from VLAN2 and vice versa.

interface Loopback0

ip address 172.0.0.1 255.255.255.0

!

interface BRI0

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

encapsulation hdlc

shutdown

!

interface ATM0

no ip address

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

pvc 8/48

  pppoe-client dial-pool-number 1

!

!

interface FastEthernet0

!

interface FastEthernet1

switchport access vlan 2

!

interface FastEthernet2

!

interface FastEthernet3

!

interface Virtual-Template1 type tunnel

ip unnumbered Loopback0

zone-member security ezvpn-zone

tunnel mode ipsec ipv4

tunnel protection ipsec profile SDM_Profile1

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$

ip address 192.168.0.2 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly

zone-member security in-zone

ip tcp adjust-mss 1452

!

interface Vlan2

ip address 192.168.10.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security in-zone

!

interface Dialer0

ip address negotiated

ip mtu 1452

ip nat outside

ip virtual-reassembly

zone-member security out-zone

encapsulation ppp

dialer pool 1

dialer-group 1

no cdp enable

ppp authentication

ppp chap

ppp chap

ppp pap

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 Dialer0

!

ip nat inside source list 1 interface Dialer0 overload

ip nat inside source list 2 interface Dialer0 overload

access-list 1 remark INSIDE_IF=Vlan1

access-list 1 remark CCP_ACL Category=2

access-list 1 permit 192.168.0.0 0.0.0.255

access-list 2 remark VLAN2

access-list 2 remark CCP_ACL Category=2

access-list 2 permit 192.0.0.0 0.255.255.255

access-list 100 remark SDM_ACL Category=128

access-list 100 permit ip host 255.255.255.255 any

access-list 100 permit ip 127.0.0.0 0.255.255.255 any

access-list 101 remark SDM_ACL Category=4

access-list 101 permit ip 192.168.0.0 0.0.0.255 any

access-list 102 remark CCP_ACL Category=128

access-list 102 permit ip any host xx.xx.xxx.xxx

dialer-list 1 protocol ip permit

I tryed make ACL 190 with dest 192.168.0.0 to deny and aply to outbond to Vlan2 interface but it still close comunication to Dialer0 and Vlan1 too.

Thnaks for any idea

Janekx

[Karsten Iwen]

Which IOS-Version are you running?

Both VLANs are member of the in-zone. With older IOS-releases all traffic inside a zone is allowed. If you upgrade to a newer 15.x-version you can build a zone-pair "in-zone" to "in-zone" and controle there which traffic should be allowed.

But in your situation the better solution could be to use different zones for Vlan1 and Vlan2.

[locus2007]

It is running 12.4.15T7

So add zone V2 fo Vlan2 and add zone to FW to get acces to internet and zone V2 to V1 restrict in friewall?

[Karsten Iwen · Accepted solution]

yes, thats the way to go. If you really don't want any communication between Vlan1 and Vlan2, then just build a new zone-pair V2-to-Internet with the needed inspection and you're done.

[Ganesh Hariharan]

Hi, 
I am fighting with problem isolating Vlans. It is 876 router and the idea is one connection to internet using Router ADSL WAN with Vlans I add Vlan2 to FE1 and Dynamic nat, DHCP for VLAN2 only and it works but  I cant make ACL to isolate VLAN1 from VLAN2 and vice versa.
interface Loopback0
ip address 172.0.0.1 255.255.255.0
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
encapsulation hdlc
shutdown
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto 
!
interface ATM0.1 point-to-point
pvc 8/48 
  pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
zone-member security ezvpn-zone
tunnel mode ipsec ipv4
tunnel protection ipsec profile SDM_Profile1
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.0.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
zone-member security in-zone
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security in-zone
!
interface Dialer0
ip address negotiated
ip mtu 1452
ip nat outside
ip virtual-reassembly
zone-member security out-zone
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication 
ppp chap 
ppp chap
ppp pap
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source list 2 interface Dialer0 overload
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 remark VLAN2
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 192.0.0.0 0.255.255.255
access-list 100 remark SDM_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 101 remark SDM_ACL Category=4
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip any host xx.xx.xxx.xxx
dialer-list 1 protocol ip permit
I tryed make ACL 190 with dest 192.168.0.0 to deny and aply to outbond to Vlan2 interface but it still close comunication to Dialer0 and Vlan1 too. 
Thnaks for any idea 
Janekx

Hello,

What  I understand from the above requirement you dont want vlan 2 to communicate with other interface, I hope you can create an acl and apply that in IN bound direction of Vlan 2.

Hope it Help !!

Ganeshh Iyer

[locus2007]

The Acls not works for me but zones works well and I can manage firewall diferently for Vlan1 and Vlan2 in zone-pairs.

Thanks for help

Jan