3

Supposing I have:

int g1/0/11
  switchport access vlan 11

int g1/0/12
  switchport access vlan 12

int Vlan11
  no ip address

int Vlan12
  no ip address

By default, do VLANs with no ACLs block inter-VLAN routing? In other words, if I plug a computer into each of those ports and assign IPs on the same range, will they be able to get to each other?

I am trying to see if VLANs with no ACLs are secure or if I have to put an ACL in place for each.

7

VLANs are entirely separate; effectively the same as two separate LANs on separate switches.

If there's a route between them. such as with a router connected to both VLANs (or routing enabled in a so-called "Layer 3 Switch"), then packets can flow, and you might want to put in ACLs to prevent it.

If your config is in a router and you add IP addresses then yes, you'll have routed traffic between them and need to prevent it if it's undesirable. (Either with ACLs or the brutal no ip route)

EDIT: A layer 3 switch is a switch with a router in it: that is, for these purposes it counts as a router..

0
4

First of all, your configuration doesn't have IP addresses assigned on L3 interfaces on your switch. So if that will remain, hosts in VLAN 11 and VLAN 12 will not be able to talk to each other.

If later you would change that and assign IP addresses to L3 interfaces on switch and then will specify them as default gateways for computers in VLAN 11 and VLAN 12 respectively, then they will be able to talk to each other. And in that case you would need ACL assigned at least to one L3 interface, to prevent that traffic exchange.

Also, as correctly stated by @jonathanjo, all that said above is valid for multilayer switch, e.g. that are able to perform routing between L3 interfaces. Not all switches are able to do so, so it would help to answer your question more correctly if you will tell what switch do you have.

2
  • Thanks a lot. Yes, using an L3 switch (Cisco 37XX series). – dthree Aug 6 '18 at 19:25
  • In that case, also matters if you have ip routing in your config. Without this line multilayer switch works as L2 switch (e.g. not routing packets between L3 interfaces) – Andrey Prokhorov Aug 7 '18 at 6:11
3

Default nature of inter-Vlan routing is , it enable routing of traffic between different Vlans. After inter -Vlan routing all vlan configured in device can communicate to each other . To block or control or restrict traffic among VLANs Access-list (ACL) configuration is mandatory in devices ..

2

The other answers I see here are for when you want to filter traffic between VLANs, which would require what are called "router ACLs". If, instead (or even additionally), you wanted to filter things on a switch (layer 2) level, so machines within a VLAN are limited to which machines on the same VLAN they can communicate with, you would need to look at what's called a VACL (or possibly even into what are called private VLANs).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.