Securing particular vlan in Catalyst 9000, LAN Switching

[Amit Kulshrestha]

Hi Everyone....My new network architecture is simple explained below, require to configure new L3 core switch (9300 series) with 10 vlans

1. Vlan 10 – 192.168.10.0/24
2. Vlan 11 – 192.168.11.0/24
3. Vlan 12 – 192.168.12.0/24
4. Vlan 13 – 192.168.13.0/24
5. Vlan 14 – 192.168.14.0/24
6. Vlan 15 – 192.168.15.0/24
7. Vlan 16 – 192.168.16.0/24
8. Vlan 17 – 192.168.17.0/24
9. Vlan 18 – 192.168.18.0/24
10. Vlan 19 – 192.168.19.0/24

My senior mgmt. has given me a new requirement like they want Vlan 15 should be secure or it should not be accessible to other vlan. Please suggest all and best possible ways which can be configured in core switch itself, also suggest if configuration change is required, no downtime problem. Do not want to use ACL. Thanks in Advance. Amit

[balaji.bandi]

VLAN ACL (VACL )is the correct one.

Example reference guide :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/vlan_acls.html

[Amit Kulshrestha]

Hello Balaji, Can we use yrf  for particular vlan (Vlan 15) which is required to secure and rest configure as normal vlan.

Regds Amit

[balaji.bandi]

Sure you can use VRF here in your case, depends on your requirement - you can with normal VLAN with VACL or VRF.

here is a configuration guide for Cat 9K VRF config.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-8/configuration_guide/ip_mcast_rtng/b_168_ip_mcast_rtng_9300_cg/configuring_vrf_lite.html

[paul driver]

Hello

if you don’t wish to use access list then to segregate that vlan you’ll need to use a VRF that’s if that switch supports it

Feature vrf

Ip vrf 15

int vlan 15

io vrf forwarding 15

Exit

ip route 0.0.0.0 0.0.0.0.0 x.x.x.x global 

thst static route will allow vlan 15 users gain external connection 

n