Segregate VLAN based on L3 subnet

Question

I have a Juniper EX switch, which receives 3 subnets (192.168.1~3.0/24) from a untagged port of upstream switch (I don't have access to that switch). Is it possible to configure the EX switch to put different subnets onto different VLANs ?

I have hosts on my side on all 3 subnets under my switch, they are all connected to access port of VLAN 10. (And the upstream port is also configured as access port VLAN 10)

I would like to have, for instance, VLAN 11 that contains only 192.168.1.0/24 traffic, VLAN 12 that contains only 192.168.2.0/24 traffic, etc. I guess this requires the switch to act as a gateway? I'm not sure how to configure it.

ps. My EX switch is not the gateway of these 3 subnets.

Answer 1

It sounds like you're in a bad situation there, and trying to make it worse. Heck, I'm game - the following should get you halfway there:

firewall {
    family ethernet-switching {
        filter SUBNET-TRAFFIC {
            term SUBNET-11 {
                from {
                    source-address {
                        192.168.1.0/24;
                    }
                }
                then vlan v11-NET11;
            }
            term SUBNET-12 {
                from {
                    source-address {
                        192.168.2.0/24;
                    }
                }
                then vlan v12-NET12;
            }
            term SUBNET-13 {
                from {
                    source-address {
                        192.168.3.0/24;
                    }
                }
                then vlan v13-NET13;
            }
        }
    }
}
interfaces {
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                filter {
                    input SUBNET-TRAFFIC;
                }
            }
        }
    }
}

Assuming your uplink interface is ge-0/0/1, the above firewall filter should catch ingress traffic and send it to the correct VLAN (remember to move all your attached devices into their correct VLANs).

As for egress traffic, that won't be so easy. Junos won't allow you to pop tags for multiple VLANs on a single egress interface (which makes sense since you'd have no idea which VLAN to send ingress traffic).