isolate ip network of vlan from other on same port

  • 0
  • 1
  • Question
  • Updated 2 years ago
  • Answered
Here is the scenario 
we have multiple VLAN's configured as follows.

VLAN 2001 setting

create vlan "vlan2001"
configure vlan vlan2001 tag 2001
configure vlan vlan2001 add ports 21-24 tagged
configure vlan vlan2001 ipaddress 10.0.0.1 255.255.255.0
configure vlan vlan2001 dhcp-address-range 10.0.0.3 - 10.0.0.100
configure vlan vlan2001 dhcp-options default-gateway 10.0.0.1
enable ipforwarding vlan vlan2001
enable dhcp ports 21-24 vlan vlan2001

There are lots of other vlans 
for example
create vlan "vlan199"
configure vlan vlan199 tag 199
configure vlan vlan199 add ports 21-24 tagged 
configure vlan vlan199 ipaddress 172.16.199.1 255.255.255.0
configure vlan vlan199 dhcp-address-range 172.16.199.2 - 172.16.199.200
configure vlan vlan199 dhcp-options default-gateway 172.16.199.1
enable ipforwarding vlan vlan199
enable dhcp ports 21-24 vlan vlan199

Similiarly we have vlan 101 to 198 with ip 172.16.<101-198>.1 and dhcp range 172.16.<101-198>199.2 - 172.16.<101-198>.200
I want that 172.16.<101-199>.x should not be able to ping 10.0.0.x
How should I do that ?

Thanks.
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb

Posted 2 years ago

  • 0
  • 1
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
i tried this

vi  no_voip_access.pol

entry one {
             if match all {
                                source-address 172.16.0.0/16 ;
                                destination-address 10.0.0.0/24 ;
                           }
                           then
                           {
                                redirect 172.16.0.1;
                           }
          }

configure  access-list  no_voip_access.pol port 21 ingress


Got
Error: ACL policy no_voip_access.pol not found

Here i was hoping that all packets with source ip 172.16.x.x and destination ip 10.0.0.x will be sent to 172.16.0.1
Photo of Pala, Zdenek

Pala, Zdenek, Employee

  • 10,186 Points 10k badge 2x thumb
configure access-list no_voip_access port 21 ingress
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
Now .
Atleast , access list is being used .
Seems no change in behaviour.
ping to 10.0.0.2 from pc with ip 172.16.199.2 fails when pc with ip 10.0.0.2 is disconnected from extreme switch.
One more thing - how do I remove access list ?
guess , rm no_voip_access.pol would not be proper ?
Photo of André Herkenrath

André Herkenrath, Employee

  • 1,962 Points 1k badge 2x thumb
If you just want to deny "Ping" then this would do it:

entry No_Ping {  if {
      protocol icmp;
      source-address 172.16.0.0/16;
      destination-address 10.0.0.0/24;
  } then {
      deny;
  }
}

If you want to isolate traffic not to enter different areas in the network. ACLs can get a pain in the back. Depending on the platform you have you can assign the vlans to different virtual routers.

So if you have the vlan 2001 in the user defined vr vr-v2001 (just an example for a name) and the vlan 199 in a different user defined vr e.g. vr-access then these vlan are isolated by default and you don't need any ACLs
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
OK

Can't find a way to disable ACL .
Photo of André Herkenrath

André Herkenrath, Employee

  • 1,962 Points 1k badge 2x thumb
unconfigure access-list no_voip_access port 21 
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
On my switch
* X460-24t.2 # unconfigure access-list no_voip_access
 done!
* X460-24t.2 # unconfigure access-list no_voip_access
  <cr>            Execute the command
  egress          Acls applied to egress
  ingress         Acls applied to ingress
No port option .
Anyway , not a problem for me .
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
One more thing ,
I did
disable ipforwarding vlan vlan199

I thought , this will prevent PC device with ip 172.16.199.2 to ping any 10.0.0.x or 172.16.<101-198>.x
That did not happen.
Photo of JeremyClarkson

JeremyClarkson

  • 1,030 Points 1k badge 2x thumb
show iproute?
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
* X460-24t.4 # disable ipforwarding vlan199
* X460-24t.5 # show iproute vlan199
Ori  Destination        Gateway         Mtr  Flags         VLAN       Duration
#d   172.16.199.0/24    172.16.199.1    1    U------um--f- vlan199    18d:21h:4m
:23s

Origin(Ori): (b) BlackHole, (be) EBGP, (bg) BGP, (bi) IBGP, (bo) BOOTP
       (ct) CBT, (d) Direct, (df) DownIF, (dv) DVMRP, (e1) ISISL1Ext
       (e2) ISISL2Ext, (h) Hardcoded, (i) ICMP, (i1) ISISL1 (i2) ISISL2
       (is) ISIS, (mb) MBGP, (mbe) MBGPExt, (mbi) MBGPInter, (mp) MPLS Lsp
       (mo) MOSPF (o) OSPF, (o1) OSPFExt1, (o2) OSPFExt2
       (oa) OSPFIntra, (oe) OSPFAsExt, (or) OSPFInter, (pd) PIM-DM, (ps) PIM-SM
       (r) RIP, (ra) RtAdvrt, (s) Static, (sv) SLB_VIP, (un) UnKnown
       (*) Preferred unicast route (@) Preferred multicast route
       (#) Preferred unicast and multicast route

Flags: (B) BlackHole, (b) BFD protection requested, (c) Compressed, (D) Dynamic
       (f) Provided to FIB, (G) Gateway, (H) Host Route, (L) Matching LDP LSP
       (l) Calculated LDP LSP, (3) L3VPN Route, (m) Multicast, (P) LPM-routing
       (p) BFD protection active, (R) Modified, (S) Static, (s) Static LSP
       (T) Matching RSVP-TE LSP, (t) Calculated RSVP-TE LSP, (u) Unicast, (U) Up


MPLS Label: (S) Bottom of Label Stack
Mask distribution:
     1 routes at length 24

Route Origin distribution:
     1 routes from Direct

Total number of routes = 1
Total number of compressed routes = 0

* X460-24t.6 # enable ipforwarding vlan199
* X460-24t.7 # show iproute vlan199
Ori  Destination        Gateway         Mtr  Flags         VLAN       Duration
#d   172.16.199.0/24    172.16.199.1    1    U------um--f- vlan199    18d:21h:8m
:27s

Origin(Ori): (b) BlackHole, (be) EBGP, (bg) BGP, (bi) IBGP, (bo) BOOTP
       (ct) CBT, (d) Direct, (df) DownIF, (dv) DVMRP, (e1) ISISL1Ext
       (e2) ISISL2Ext, (h) Hardcoded, (i) ICMP, (i1) ISISL1 (i2) ISISL2
       (is) ISIS, (mb) MBGP, (mbe) MBGPExt, (mbi) MBGPInter, (mp) MPLS Lsp
       (mo) MOSPF (o) OSPF, (o1) OSPFExt1, (o2) OSPFExt2
       (oa) OSPFIntra, (oe) OSPFAsExt, (or) OSPFInter, (pd) PIM-DM, (ps) PIM-SM
       (r) RIP, (ra) RtAdvrt, (s) Static, (sv) SLB_VIP, (un) UnKnown
       (*) Preferred unicast route (@) Preferred multicast route
       (#) Preferred unicast and multicast route

Flags: (B) BlackHole, (b) BFD protection requested, (c) Compressed, (D) Dynamic
       (f) Provided to FIB, (G) Gateway, (H) Host Route, (L) Matching LDP LSP
       (l) Calculated LDP LSP, (3) L3VPN Route, (m) Multicast, (P) LPM-routing
       (p) BFD protection active, (R) Modified, (S) Static, (s) Static LSP
       (T) Matching RSVP-TE LSP, (t) Calculated RSVP-TE LSP, (u) Unicast, (U) Up


MPLS Label: (S) Bottom of Label Stack
Mask distribution:
     1 routes at length 24

Route Origin distribution:
     1 routes from Direct

Total number of routes = 1
Total number of compressed routes = 0

One thing I noticed that on disabling ipforwarding .
ping to DNS server (which is outside the switch) stops and works on enabling  ipforwarding .
Photo of JeremyClarkson

JeremyClarkson

  • 1,030 Points 1k badge 2x thumb
show iproute (end) output so we can see everything.
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
http://pastebin.com/Y9uvLWsC

it's a 479 line file of 40kB .
(Edited)
Photo of André Herkenrath

André Herkenrath, Employee

  • 1,962 Points 1k badge 2x thumb
I saw a lots of routes and vlans. What is the solution you plan to build ?
Photo of JeremyClarkson

JeremyClarkson

  • 1,030 Points 1k badge 2x thumb
wow...thats alot....

can you not just disable ipforwarding on the default VR?
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
Finally my aim is that network of vlan 2001 (10.0.1/24) and vlan1967(172.16.92.1/24) should not be accessible to other vlans.
All other vlans may access each other's gateway.
The trunk port(21-24) will get data of all vlans.

To have less complication let's forget vlan1967.
So, If I could keep vlan 2001 network inaccessible to other vlan.
Also , can do if other vlan's do or don't ping each other's network.

This virtual router concept I couldn't grasp.
[quote]
So if you have the vlan 2001 in the user defined vr vr-v2001 (just an example for a name) and the vlan 199 in a different user defined vr e.g. vr-access then these vlan are isolated by default and you don't need any ACLs
[/quote]

[quote]
can you not just disable ipforwarding on the default VR?
[/quote]
Photo of JeremyClarkson

JeremyClarkson

  • 1,030 Points 1k badge 2x thumb
"This virtual router concept I couldn't grasp."

food for thought????
Photo of André Herkenrath

André Herkenrath, Employee

  • 1,962 Points 1k badge 2x thumb
EXOS always uses virtual router. as long as all vlans are within one vr they can communicate.
If you create another vr and put the vlans inside of this vr, these vlans can't communicate with the rest.
Photo of André Herkenrath

André Herkenrath, Employee

  • 1,962 Points 1k badge 2x thumb
Photo of JeremyClarkson

JeremyClarkson

  • 1,030 Points 1k badge 2x thumb
Also the Command Reference Guide has alot on VR.

Sorry cant find the doc link.
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
ok
i will read references
then reply back .
1818 page pdf .pretty detailed.nice.
(Edited)
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
this is what I did

* X460-24t.3 # configure vlan vlan2001 delete ports all
* X460-24t.4 # delete vlan vlan2001
Previously , vlan2001 was in default virtual-router

* X460-24t.5 # virtual-router voip2001
* (vr voip2001) X460-24t.6 # create vlan "vlan2001"
* (vr voip2001) X460-24t.7 # configure vlan vlan2001 tag 2001
* (vr voip2001) X460-24t.8 # configure vlan vlan2001 add ports 21-24 tagged
Error: Port 21 belongs to virtual router VR-Default. VLAN is created on virtual-router voip2001
* X460-24t.11 # configure "VR-Default" delete ports 21-24
Error: Port 21 belongs to 426 VLAN(s). Delete the port from the VLAN(s)
* X460-24t.10 # show virtual-router "VR-Default"
Virtual Router        : VR-Default                Type : System
Description           : Default VR
Operational State     : Up         
IPv4 Admin State      : Enabled     IPv6 Admin State   : Enabled
IPv4 Route Sharing    : Disabled    IPv6 Route Sharing : Disabled
L3VPN SNMP Traps      : Disabled
Protocols Configured  :
--------------------------------------------------------------------
Protocol    Process       Configuration    Protocol 
Name        Name          Module Name      Instances
--------------------------------------------------------------------
RIP         rip           rip                      1
RIPng       ripng         ripng                    1
--------------------------------------------------------------------
Port List             : 1-30
VLANS:
...
lots of vlans
...
Virtual Router Totals :
Total Protocols       :     2    Max Protocols         :     8
Total Ports           :    30
Total Vlans           :   428
Total IPv4 Vlans      :   427    Total Ipv6 Vlans      :     0
Active IPv4 Vlans     :   425    Active Ipv6 Vlans     :     0
Inactive IPv4 Vlans   :     2    Inactive Ipv6 Vlans   :     0

Will I have to run
configure vlan <vlan_name> delete ports 21-24
for all 428 of these.
Then only I can add two virtual routers (vr-default and voip2001) to ports 21-24 ?
(Edited)
Photo of Pala, Zdenek

Pala, Zdenek, Employee

  • 10,186 Points 10k badge 2x thumb
You need to delete the port from all VR's than you can add more vlans (with different VR's to the port).

So yes you need to delete the port from all VLANs, than you can delete the port from VR, than you can add those VLANS again to the port.

Regards

Z.
Photo of sumeet

sumeet

  • 798 Points 500 badge 2x thumb
did it .
I hosted two virtual routers on port 21 of my switch .
Works as desired.
thank you all .
Photo of JeremyClarkson

JeremyClarkson

  • 1,030 Points 1k badge 2x thumb
awesome!