3

I want to divide my network into smaller segments.
I want to use our HPE FF 5700-40XG-2QSFP+ switch as the router. It runs comware 7.

VLAN 101 for servers, using 10.101.0.0/16, interface ip 10.101.1.100
VLAN 102 for building A, using 10.102.0.0/16 interface ip 10.102.1.100
...
VLAN 105 for building D, using 10.105.0.0/16 interface ip 10.105.1.100

At the moment all VLANs can talk to each other.

I want:

VLAN 102 to have access to VLAN 101
VLAN 103 to have access to VLAN 101
...
VLAN 105 to have access to VLAN 101

But I want to make sure they can not reach each other.
So no traffic from VLAN 102 to VLAN 103 or VLAN 104 etc.

I wanted to try this, but failed:
- create a VPN instance for each VLAN, so it will have its own routing table
- for each VPN instance: create a route between the VPN instance and the VPN instance of VLAN 101

I also tried doing it with policy based routing and ACL's but I was also not able to figure that out.

Maybe that's not the way to go, or maybe I'm not doing it right.

Who can help me figure this out? It seems so basic..

Improve this question
1
  • 1
    I have no clue what a HPE 5700 is so can't help with the syntax but typically you solve this by by just using access-lists, nothing more. Can you edit your question and add the configuration you tried to add?
    – hertitu
    Commented Nov 7, 2016 at 18:50

2 Answers 2

Reset to default
3

I believe you are over-complicating things. A VPN Instance in the HPE Comware world is essentially a VRF in the Cisco world... and you don't need a VRF to keep a few VLANs from talking to each other. Neither do you need Policy Routing. ACLs should work just fine.

You can find the relevant HPE documentation here : http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04565674&DocLang=en&docLocale=en_US

Essentially, you would create an IPv4 advanced ACL and add two rules to it, one allowing traffic to VLAN 101, and the other denying everything else, and then apply it outbound on the vlan interfaces for vlans 102 to 105.

Improve this answer
2
  • Do you even need the second rule? Isn't there an implicit deny as on Cisco?
    – hertitu
    Commented Nov 7, 2016 at 23:42
  • 1
    You can have it setup both ways, but I believe the default is actually an implicit permit... So I usually prefer to be explicit about it, just in case.
    – Jeremy Gibbons
    Commented Nov 8, 2016 at 3:21
3

Thanks guys, I was able to figure it out using your help.

These are the commands that I use per VLAN:

acl number 3102 name "traffic rules VLAN 102" match-order config
rule permit ip source 10.102.0.0 0.0.255.255 destination 10.101.0.0 0.0.255.255
rule permit ip source 10.101.0.0 0.0.255.255 destination 10.102.0.0 0.0.255.255
rule deny ip
int vlan 102
ip address 10.102.1.100 16
packet-filter 3102 outbound

I added an explicit "rule deny ip" just to be sure that everything else will be blocked.

The HP documentation reads: By default, the packet filter permits packets that do not match any ACL rule to pass. You can set the packet filtering default action to deny by using this command:

packet-filter default deny

I should also say that I don't create an ACL for VLAN 101, so that from this VLAN's point of view, all traffic will be allowed between this VLAN and all the others.

This means that I also have to create an ACL for each VLAN that I want to be isolated from all the others. Here's an example for VLAN 6: 

acl number 3006 name "traffic rules VLAN 6" match-order config
rule deny ip
int vlan 6
ip address 10.6.1.100 16
packet-filter 3006 outbound

I realize that communication would not be possible if I didn't add an interface on the switch for this VLAN.

Anyway, thanks a lot to all you guys for showing me the way!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.