I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal subnet do not communicate with each other? Is there something going on at the layer 2 level?
1
-
Please pick one site and ask there. If you don't get a good response, you can delete and re-ask on the other site, post a bounty on the questions, or flag it and ask for it to be migrated. Do not cross post: serverfault.com/questions/685473/…– YLearnApr 25, 2015 at 3:29
Add a comment
|
1 Answer
There are many ways to restrict Layer 2 traffic between hosts. VLAN ACLs (VACLs) is one method. Private VLANs (PVLANs) is another and I'll leave that for others to provide examples.
VLAN ACLs can be use in L2 to filter bridged traffic between hosts or to filter L3 traffic routed into or out of the VLAN based on standard/extended IP/MAC ACLs and VLAN access maps.
L3 filter of rfc1518 addresses example:
ip access-list extended rfc1518 ! define common rfc1518 networks permit ip 10.0.0.0 0.255.255.255 any permit ip 172.16.0.0 0.15.255.255 any permit ip 192.168.0.0 0.0.255.255 any vlan access-map vacl-allow-rfc1518 ! define vlan access match/action match ip address rfc1518 action forward ! forward rfc1518 addresses vlan filter vacl-den-rfc1518 vlan-list 10 ! apply to vlan 10
L2 filter of two MAC hosts example:
mac host mac1 0000.1111.2222 mac host mac2 3333.4444.5555 mac access-list extended good-bad-macs ! the good, the bad, and the ugly deny host mac1 host mac2 ! mac1-to-mac2 (ugly) deny host mac2 host mac1 ! mac2-to-mac1 (bad) permit any any ! all other macs (good) vlan access-map mac-talkers match mac address good-bad-macs ! let mac acl define who's allowed to talk action forward vlan filter mac-talkers vlan-list 10
Implicit drop action at end of vlan access-map.
answered Apr 25, 2015 at 2:54
