topic Re: intra-vlan traffic block in ExtremeSwitching (EXOS/Switch Engine)

intra-vlan traffic block

Giuseppe_Montan — Mon, 12 Jun 2023 08:15:35 GMT

Good Morning, I am looking a way to block intravlan traffic.

I have a couple of 5520 as core and lot of X440G2 as access.

I have a Vlan that is configured over all switches.

It can communicate with Internet and other vlan but the users on this vlan can not communicate eachother.

Probably privatevlan is the right way but i can not confgure on core switch ( cause the subscriver vlan has ip address configured )

Anyone know hot to solve ?

Thanks

Giuseppe

gfriedl — Mon, 12 Jun 2023 09:09:27 GMT

i would build an IP ACL, that redirect all IP packets to the default Gateway IP of choice ... drop all other ip packets.

Giuseppe_Montan — Mon, 12 Jun 2023 09:16:25 GMT

Thanks, can you give me an example ?

Giuseppe

OscarK — Mon, 12 Jun 2023 12:39:38 GMT

Take a look at port isolation for the core switch, very simple.

Ports with isolation set to on cannot communicate with eachother.

Giuseppe_Montan — Wed, 14 Jun 2023 12:41:13 GMT

I used a dynamic ACL 😞 but I am not shure is the right way ( It works but I do not like it )

I tried also to block traffic between VLAN in only one way

source 192.168.199.0 to destination 192.168.188.0 DENY

source 192.168.188.0 to destination 192.168.199.0 PERMIT

If I create the first dynamic ACL I deny all traffic ( ingress and egress ) between this vlan and this is not I need.

Giuseppe