05-02-2021 08:17 PM
Hello. I have a VLAN and I would like to iscolate all traffic within the VLAN so devices within the same VLAN cannot communicate with each other. What is the best way to go about this?
Solved! Go to Solution.
05-02-2021 10:06 PM
Single switch or multiple switches?
there are generally two features that could be used:
Best regards
Stefan
05-06-2021 08:27 PM
Hi,
Do you mean the VMs to be isolated? Would Direct Attach feature (aka EVB/VEPA) do the job to pull the inter-VM traffic out of a vSwitch to control it entirely on EXOS? Then, if you need L3 communication isolation in the same subnet, an ACL or a Policy to block every IP in that subnet (besides the default GW if needed) might do the work. If you need L2 isolation and you cannot do separate port groups/VLANs, some sort of dmac blacklist would have to be created (ACL or Policy, static blackhole fdb entries would prevent these MAC addresses from any communication at all).
Hope that helps,
Tomasz
05-03-2021 11:56 AM
Hi Stefan,
It is a single switch stack, two X440 switches. Connected to the switch is a hypervisor cluster; on the hypervisor cluster, we have a vSwitch tagged to the VLAN, which various virtual machines use. We have firewall rules restricting traffic between the VLAN, but we need the clients isolated from each other in this specific VLAN.
05-02-2021 10:06 PM
Single switch or multiple switches?
there are generally two features that could be used:
Best regards
Stefan