2

I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal subnet do not communicate with each other? Is there something going on at the layer 2 level?

  • Please pick one site and ask there. If you don't get a good response, you can delete and re-ask on the other site, post a bounty on the questions, or flag it and ask for it to be migrated. Do not cross post: serverfault.com/questions/685473/… – YLearn Apr 25 '15 at 3:29
3

There are many ways to restrict Layer 2 traffic between hosts. VLAN ACLs (VACLs) is one method. Private VLANs (PVLANs) is another and I'll leave that for others to provide examples.

VLAN ACLs can be use in L2 to filter bridged traffic between hosts or to filter L3 traffic routed into or out of the VLAN based on standard/extended IP/MAC ACLs and VLAN access maps.

L3 filter of rfc1518 addresses example:

ip access-list extended rfc1518 ! define common rfc1518 networks
 permit ip 10.0.0.0 0.255.255.255 any
 permit ip 172.16.0.0 0.15.255.255 any
 permit ip 192.168.0.0 0.0.255.255 any
vlan access-map vacl-allow-rfc1518 ! define vlan access match/action
 match ip address rfc1518
 action forward ! forward rfc1518 addresses
vlan filter vacl-den-rfc1518 vlan-list 10 ! apply to vlan 10

L2 filter of two MAC hosts example:

mac host mac1 0000.1111.2222
mac host mac2 3333.4444.5555
mac access-list extended good-bad-macs ! the good, the bad, and the ugly
 deny host mac1 host mac2 ! mac1-to-mac2 (ugly)
 deny host mac2 host mac1 ! mac2-to-mac1 (bad)
 permit any any ! all other macs (good)
vlan access-map mac-talkers
 match mac address good-bad-macs ! let mac acl define who's allowed to talk
 action forward
vlan filter mac-talkers vlan-list 10

Implicit drop action at end of vlan access-map.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.