• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Need VLAN isolation help

A

abyssling

n00b
Joined
Feb 21, 2002
Messages
43
I am looking for info on isolating VLAN traffic so that it only goes to the gateway/fw, or to a specified application server, but isolates the traffic from the rest of the network.

I want to deploy a solution for internet access for kiosk pc's and in conference rooms for visiting presenters/educators where they will need internet access but will be denied access to the rest of the network.

Can any Cisco gurus give me a hand on how I could accomplish this on a 2950G?

Also in a separate scenario I would like to create another VLAN only giving access to a specified application server, the domain controller for authentication and the internet but denying all other traffic. This is on a Baystack 450. These machines will be using static IP's so DHCP is not an issue.

Do I just create a VLAN and only grant access to those IP's in the ACL? is it that simple? Reason for my conundrum is I was always told that the 2950 is not capable of an isolation VLAN, or is this not the technical definition of an isolation VLAN? Can anyone give me a hand?
 
I made a VLAN on one of my 6509's and ACL'ed the crap out of to accomplish a similar thing. They can talk to our DHCP server (via the helper-address) so their IPs are assigned automagically, but they can't even ping their gateway IP :D This is likely not the best/easiest way to do this, but it works for me.

interface Vlan69
description ***guest vlan with dhcp***
ip address 10.11.69.1 255.255.255.0
ip access-group guest-lock-down-in in
ip access-group guest-lock-down out
ip helper-address 10.5.1.24
no ip redirects

!

ip access-list extended guest-lock-down
deny ip 10.5.1.0 0.0.0.255 any
deny ip 10.0.0.0 0.255.255.255 any
deny ip 192.168.1.0 0.0.0.255 any
deny ip 172.16.0.0 0.0.255.255 any
permit ip any any
ip access-list extended guest-lock-down-in
deny ip any 10.0.0.0 0.255.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 172.16.0.0 0.0.255.255
permit ip any any
 
You must log in or register to reply here.
Back
Top