0

I have a printer attached to a network that I would like to be accessible only from one computer on the network. What are my options to accomplish this? I have a HP2530-48G switch under my hand if that could be useful.

0

You should be able to use access-lists for this. Check the "Access Security Guide" for the 2530.

Something along the line of allow any <IP of computer>/32 <IP of printer>/32 and vice versa applied to the printer port. The deny any is implicit.

Make sure you're able to access the switch via serial console before experimenting with ACLs.

2
  • If I were to use two VLANs with both using the same subnet. I put all computers that should not access the printer on let say VLAN1 and I put the printer on VLAN2. If I set the only computer to access the printer as tagged on VLAN2 and untagged on VLAN1, would that work? – Pat Aug 1 '17 at 11:00
  • Two VLANs with both using the same subnet breaks communications. VLANs do not (L2) communicate with each other. With two identical subnets you can't route either. You can either use two VLANs with two different subnets, set up routing and filter that route to what you require. Or you simply use ACLs on the printer port to filter out all traffic you don't want with the single VLAN/subnet you have. – Zac67 Aug 1 '17 at 21:10
1

Following Zac67 idea, here are the steps to make this work using the HP2530. My printer is connected to the port 43 on the switch and has the ip 10.1.1.11 and the only computer that can access the printer is 10.1.1.10.

// Enable configuration mode
configure

// Create the ACL PrinterACL
ip access-list extended PrinterACL

// Create two ACE has Zac67 recommended
10 permit ip 10.1.1.10 0.0.0.0 10.1.1.11 0.0.0.0 
20 permit ip 10.1.1.11 0.0.0.0 10.1.1.10 0.0.0.0 

// Exit ACL
exit 

// Set the ACL on port 43
interface 43 ip access-group PrinterACL in

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.