I have a switch network consist of 4 PCs and one switch

  • pc1:
  • pc2:
  • pc3:
  • pc4:

Using Packet tracer, I want to allow pc3 to send and receive ping from pc2 only, and pc1 send and receive ping from pc4 only, otherwise no ping between any PCs.

How can I do this and with which commands please?

  • Hello Imad, welcome. The usual way is to make two VLANs, either by port or by MAC addresses. You'll have to tell us your switch manufacturer and model as the commands vary a lot between one kind and another.
    – jonathanjo
    Commented Nov 4, 2018 at 15:29
  • Traffic on the same broadcast domain is delivered directly from host-to-host. A switch (bridge) is a transparent device. You need to get to layer-3 (routing), where you can put in access lists to allow or deny traffic between networks. Ping uses ICMP, which is part of IP (a layer-3 protocol), and invisible to a switch.
    – Ron Maupin
    Commented Nov 4, 2018 at 15:34
  • @jonathanjo I'm using cisco packet tracer generic switch. Commented Nov 4, 2018 at 15:39
  • ... the different answers depend on how you decide which traffic to block. if it's by socket on the switch, you can use per-port VLANs; if it's by MAC address, per-MAC VLANs; if it's by IP address, then (per Ron M), you need a router, but guessing from your IP addresses and phrasing you'll want a switch solution, which blocks more than just the ICMP you mention.
    – jonathanjo
    Commented Nov 4, 2018 at 17:05
  • 2
    Packet Tracer, designed for passing the CCNA, is lacking in many advanced features. Most of the suggestions here probably will not work. You can get VIRL or GNS3 to run advanced features, otherwise I think you need to do this at layer-3.
    – Ron Maupin
    Commented Nov 4, 2018 at 18:16

3 Answers 3


You need to use private-vlans. Private vlans are used in a case where devices on the same subnet and vlan need to be separated from one another. For example in a hotel floor you may have devices in each room in the same vlan but you don't want one guest to sniff other guest's traffic.

To acheive this you need private-vlans consisting of two communities.

Private-vlans is composed of primary and secondary members. Promiscuous will be member of primary vlan but isolated and community will be member of secondary.

Members of same community can talk to each other but not to different communities.

Members of isolated vlan cannot talk to other isolated vlans or communities.

But both community and isolated can talk to the promiscuous which is the port that is connected to the router.

You need to put pc2 & pc3 in one community and pc1 & 4 in another community. So each pair will be able to communicate between with one another but not with the other community members.

To visually illustrate it

vlan 1000
    2001 - community - pc1 & pc4 should be here.
    2002 - community - pc2 & pc3 should be here.

Hope it made sense to you.

You can read more about private vlans here: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs.html#42874


You can do this with private VLANs if your switch supports it.

Create a community secondary VLAN which contains pc2 and pc3

Create another community secondary VLAN which contains pc1 and pc4

Community VLAN members can only speak to each other and any promiscuous ports

All 4 hosts should be members of the same primary VLAN

If you have a router that the hosts need to speak to, you can configure the router port on the switch as a promiscuous port (any member of the private VLAN can speak to this port)

See this article for further details:


Another option (if your switch supports it) is VLAN ACLs. VACLs are applied to all bridged traffic within a VLAN. See the following for further details:



If it is a layer 2 switch, you will need to set up a router (router on a stick) using sub interfaces and trunking. If it is a layer 3 switch, you can set up routing on that and leave out the router. Search for “router on a stick” commands.

  • Hi eldragon; the question does say they are on the same LAN
    – jonathanjo
    Commented Nov 4, 2018 at 17:11
  • Hi, I gave this solution because he is using packet tracer.
    – eldragon
    Commented Nov 4, 2018 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.