1

Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on the LAN, unless specifically authorized in a firewall configuration for each port?

A typical application would be in a semi-public space where people may be bringing in personal devices which could potentially be plugged into the wired building network, to limit device discovery and nmap address probing.

I'm thinking that it is probably possible to implement manually, but it would require some ridiculously complex configuration, such as assigning each individual Ethernet jack on the switches to a separate VLAN, and then in a router create separate firewall rule groups for each VLAN interface.

Using VLANs for this would only work up to the maximum 4096 VLANs. If an organization has more wired wall ports than that, then apparently the network would require physical cabling isolation and individual router NICs/cabling, to allow reuse of VLAN IDs on each router NIC.

Or perhaps use distributed routers in network closets to handle the physically segmented VLAN re-use groups, rather than having a single huge router in the main datacenter.

Is there any switch equipment which already provides this sort of individually firewalled ethernet port isolation?

  • 1
    I'll just leave this link here, as i don't have time to turn it into a real answer: en.wikipedia.org/wiki/Private_VLAN – Silent-Bob Nov 9 '15 at 9:20
  • Just a quick FYI in regards to this statement - "Using VLANs for this would only work up to the maximum 4096 VLANs. If an organization has more wired wall ports than that, then apparently the network would require physical cabling isolation and individual router NICs/cabling, to allow reuse of VLAN IDs on each router NIC." - You can use VDCs to break up one physical device into several logical devices. This would remove the VLAN limitation you speak of without having to buy additional hardware. – OzNetNerd Nov 11 '15 at 1:57
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 13:55
3

Cisco switches have a feature called Private VLANs (other mfrs name it differently). You can configure the port so it can only talk to the gateway port and no others on the same VLAN. This would accomplish what you're asking for.

But I'm very skeptical that this is what you really need. I would like to understand your security requirements better.

| improve this answer | |
3

As @Silent-Bob suggested, private or isolated VLANs will keep devices from communicating with each other on the same VLAN. I'm not sure that's exactly what you want.

Most companies set up a VLAN for such a scenarios if guests or BYOD is allowed. The VLAN can be firewalled from the rest of the network. It is not a good idea to allow any device you don't control to be able to access your network, and most companies limit such devices to allow access to and from the Internet only.

Also, see this question: How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.