Sharing a printer between 2 VLANS

[bilskya666]

We have a SGE2010 48 port POE switch and need to share a printer with a subtennant.  We do not want to give them access to any other resources.

Our LAN is 192.168.17.0/24  - the printer is at 192.168.17.50

The sub-tennats LAN is 10.0.1.0/24.

I belive I need to setup 3 VLANs -

10 - Us

20 - Subtennant

30 - Printer.

Is this correct and if so, how do we setup the VLANS?   Many thanks in advance for your suggsestions.

[jan.janovic.sk]

Hello there,

According to documentation for this switch it can be configured only via web interface. I'm not sure if it wont be too limiting for this scenario.

However, the thing is when you want to use several VLANs, you will need a routing between them. It would be sufficient to make only 2 VLAN(because your printer is in the same network as you) - VLAN 10 for you and VLAN 20 for subtenant. Now you should try to configure static routing between them(your switch should support it) and then use an extended ACL on interfaces in subtenant VLAN. With this ACL you can permit only trafic from network 10.0.1.0 to printer 192.168.17.50, nothing else.

I have no experiences with configuring cisco devices without IOS, so i cant tell you more exact procedure how to configure all this. Take it only as a theoretical hint and try it yourself. I believe there is no way to go wrong

Best Regards

Jan Janovic

[Alessio Andreoli]

If your printer is in the same subnet than yours, then you can't set up 3 vlans

To set 3 vlan you should have for example:

192.168.16.0/24 -subtenants

192.168.17.0/24- printer

192.168.18.0/24- your own vlan

Jan, just above was right to suggest a layer 3 point (static route), because in this way the 3 subnets can have a communication and the subtenants can contact the printer. Access-list and filters can be applied to deny traffic to elsewhere but printer and Internet.

HTH

Alessio

[nkarthikeyan]

Hi bill,

You can keep userlan and printer on the same vlan. for subtenants you can create a seperate vlan and put an access-list like the below.

ip access-list subtenants_block

permit tcp any host 192.168.17.50

deny ip any 192.168.17.0 255.255.255.0

permit ip any any

!

int vlan 20 (subtenants)

ip access-group subtenants_block

!

Please do rate if the given information helps.

By

Karthik