topic RE: VLAN separation with common access to one vlan in ExtremeCloud IQ- Site Engine Management Center

VLAN separation with common access to one vlan

Juergen_Graefe — Wed, 11 Oct 2017 17:34:00 GMT

Hello,
our customer has 18 tenants in a building which share a common it infrastructure. Each tenant should be able to access the common resource telephone system and internet. The tenant networks should be separated.
What I did:
a vlan for each tenant with an ip address as a tenant gateway
ipforwarding for all vlans
Is there a possibility to separate the tenant networks, without for each tenant a traffik deny for all other tenants to place?
Switch: X460 G2, FW: 22.3.1.4
Software: NetSight
Thanks in advance
Best Regards
Juergen Graefe

RE: VLAN separation with common access to one vlan

Pascal_Lurquin — Wed, 11 Oct 2017 17:37:00 GMT

configure private-vlan name add networkv lan_name

http://extrcdn.extremenetworks.com/wp-content/uploads/2014/04/Layer_2_Basics.pdf

RE: VLAN separation with common access to one vlan

Pascal_Lurquin — Wed, 11 Oct 2017 17:38:00 GMT

Or use the ACL with ICMP redirect to force the Stream to (for example) a firewall.

Don't forget to implement the return of the Stream !

RE: VLAN separation with common access to one vlan

Juergen_Graefe — Wed, 11 Oct 2017 18:21:00 GMT

Thanks pascal for your replay.
I have private vlan "inet" configured
create private-vlan InetPriv
configure private-vlan InetPriv add networkv "Inet"
If I then try to add a tenant vlan as "non-isolated"
configure private-vlan InetPriv add subscriber "ForIB" non-isolated
I get the error "Subscriber VLAN can not have ip address Configured"
This IP address I need, but nevertheless the routing for this tenant works?

RE: VLAN separation with common access to one vlan

Pascal_Lurquin — Mon, 16 Oct 2017 20:34:00 GMT

Is it what you are looking for ?

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-private-vlan

RE: VLAN separation with common access to one vlan

Juergen_Graefe — Tue, 17 Oct 2017 15:03:00 GMT

I have solved the problem by having ipforwarding enabled for all vlans and
for each tenant I has created an access list with a mutual exclusion.
Thanks for replay

RE: VLAN separation with common access to one vlan

Pascal_Lurquin — Tue, 17 Oct 2017 16:41:00 GMT

This it what I used ... ACLs are very easy with Extreme Networks 🙂

It's not the case with Cisco ...

Anyway your problem was solved : Great !