3

At our ISP's we use Huawei s5300 switches, and we want to upgrade our setup to accomplish the following:

  1. Place a number of different customers/users under same VLAN.
  2. Assign one static-public IP address per client/customer and prevent them use another IP address from the same subnet.
  3. Isolate each client/interface in the same VLAN, effectively having them as if they are part of different VLAN. The goal is to prevent broadcast-based network auto-discovery protocols that can locate all hosts under the same broadcast domain.

The idea is to: a) save on IP addresses since if we put each client in a separate VLAN we "lose" at least 3 IPs, and b) avoid using MUX VLAN (Private VLAN in Cisco terms) due to configuration complexity.

We are stuck at point 3. If customers terminate the public IP on a server, then for instance Customer A can see the server of Customer B,C,D in Windows network folder. Here is a sample configuration for clients connected to interface 0/0/3 and 0/0/4. As we learned from the net the command "port-isolate enable group 1" may do the trick but for us it had no effect - we need isolation to work across multiple switches.

[Huawei Router]
interface Vlanif2 (The subnet is based on public IP addresses)
ip address X.X.X.X 255.255.255.0
........
[Huawei Switch 1]
user-bind static ip-address X.X.X.19 interface GigabitEthernet0/0/3
interface GigabitEthernet0/0/3
  port link-type access
  port default vlan 2
  port-isolate enable group 1
  arp anti-attack check user-  bind enable
[Huawei Switch 2]
user-bind static ip-address X.X.X.20 interface GigabitEthernet0/0/4
interface GigabitEthernet0/0/4
  port link-type access
  port default vlan 2
  port-isolate enable group 1
  arp anti-attack check user-bind enable
</code>

Thanks in advance.

[EDIT] 1. Code snippet changed - commands segmented into more devices. 2. Added information that port isolation should work across multiple switches.

  • 3
    I don't know about Huawei, but many Cisco switches support Private VLANs that seem to be what you are looking for. Just remember, if a device can't use broadcast to locate another device in the same layer-2 domain, it can't communicate to it since ARP would be disabled. – Ron Maupin Aug 24 '15 at 19:34
  • @Ron Maupin: Huawei supports Private LAN (called MUX VLAN), but we're trying to find a way to achieve the same result without using it, in order to: save VLAN IDs and avoid the configuration complexity of adding new sub-vlan for each client in case of setting up hundreds of clients. To keep the communication between them, we can use ARP proxy and let them communicate over layer 3. – Marcus Frenkel Aug 24 '15 at 20:36
  • VLANs limit layer-2 connectivity. Layer-2 communication restrictions in a single VLAN are typically handled by Private, Isolated, and/or Community VLANs. In some switches, with some vendors, you can use ACLs to restrict layer-2 communications. It can all get very complex and unwieldy. You should use VLANs for what they were designed to do. If you end up with hundreds of VLANs that each must have unique numbers, you probably need to redesign. With a layer-3 (router) separation, you can reuse VLAN numbers. It sounds like you want separate VLAN benefits without separate VLANs. – Ron Maupin Aug 24 '15 at 22:34
  • @Ron Maupin: What is the standard method used by ISPs when they deliver service over a single static public IP? Do they create separate VLAN for each customer, or they keep them all in one VLAN without paying attention to the potential security risks of network discovery of other customers under the same VLAN? – Marcus Frenkel Aug 26 '15 at 8:01
  • ISPs don't have an ethernet switch with ethernet cables running to each customer. What ISPs use depends on the technology used to deliver the service. Cable, DSL, TDM, etc. are not ethernet on a switch using MAC addresses. – Ron Maupin Aug 26 '15 at 12:18
1

"port-isolate enable group 1" command drops communication between the member ports and only communicate with non member ports. Configuration done by you is correct but you can implement this in your network if you have only one switch or else it not going to be useful for you. Normally this should drop the communication between A and B. If you are using only one switch in your network try to ping A to B and B to A if you are able to ping each other even after implementing port isolate then contact TAC it could be a bug in IOS.

IF you have mutliple switches then it will work differently, please look at below for better idea. Scenario:

  1. A, B are in switch1 on vlan 10 and port isolated
  2. C, D are in swtich2 on vlan 10 and port isolated
  3. A IP x.x.x.10
  4. B IP x.x.x.11
  5. C IP x.x.x.12
  6. D IP x.x.x.13

Here A can communicate with C and D but not B. C can communicate with A and B but not D.

  • Exactly, we need port isolation across multiple switches, specifically to avoid broadcast-based network discovery. Any workaround? When it comes to communication between clients, we can make A,B,C,D ping each-other with ARP proxy: [Switch-Vlanif2] arp-proxy inner-sub-vlan-proxy enable. – Marcus Frenkel Aug 24 '15 at 20:57
  • I think it may be possible by port isolation doing on vlan rather than the interface. I don't know exactly but there was a concept like create a port isolation group x in the vlan source switch and apply the same group wherever you have forwarded the vlan in multiple switches. – Sriborn2do Aug 24 '15 at 21:39
0

Configuring Protected Ports

Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch.

Not sure your Huawei switch has this feature. It appears to be a layer 2 switch. I was going to recommend ACL's to achieve it but it likely won't have that if layer 2 only.

-1

The solutions is available in this document, under the section:

5.5.2 Example for Configuring Inter-Device MUX VLAN

  • 1
    You should include the relevant information in your answer. Link only answers are strongly discouraged since the links may be broken in the future. You should quote the relevant information and provide the link. – Ron Maupin Jan 18 '16 at 16:44
-2

Have you tried a L2 access list ?

Allow all traffic to and from default-gateway mac.
Block all other traffic.

Put this on each customer port.

  • 2
    You would also have to allow broadcast as a destination, otherwise things like DHCP and ARP would not work, creating other issues. – YLearn Aug 25 '15 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.