Say I have an uplink port (1/3/1) connected to our upstream, then various clients across 1/1/1 - 1/1/48. I want to create two or more VLANs where each VLAN can only use IPs from a specific subnet.


vlan 101
tag e 1/3/1
untag e 1/1/1 to 1/1/24
(assign to vlan 101)?

vlan 102
tag e 1/3/1
untag e 1/1/25 to 1/1/48
(assign to vlan 102)?

(route vlan 101 & 102 traffic through 1/3/1)?

I want to prevent a host in vlan 102 (e.g. 1/1/25) from using an IP that belongs to vlan 101 (e.g. and vice versa.

What's the best way to accomplish this?

Note that this switch is layer 3 capable.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:12

Justin, I'm not aware of any feature from a switch vendor that will inspect the layer 2 traffic on a VLAN to enforce layer 3 addressing. If you assign Virtual Ethernet interfaces (Brocade name equivalent to the Cisco SVI, basically a routed interface into the VLAN) to these VLANs, other devices on the VLAN would only be able to use IP addresses within the same subnet as the VE IP address to be able to use the switch as a default gateway and get routing services off of that subnet & VLAN. This would not prevent two or more devices on the VLAN from using a separate IP subnet and being able to communicate with any other device in the same subnet on the same VLAN. However, these devices will not be all that useful, as they will not be able to reach any other services, as they won't have a valid default gateway to allow them to talk to other subnets, servers, the Internet, etc.

| improve this answer | |

I don't think there's a way to enforce client IP addressing at the switch, however if you have control of the clients, you could prevent them from statically assigning their IP's and stand up a DHCP server on the VLAN that only hands out approved IP's.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.