I have a switch network consist of 4 PCs and one switch
Using Packet tracer, I want to allow pc3 to send and receive ping from pc2 only, and pc1 send and receive ping from pc4 only, otherwise no ping between any PCs.
How can I do this and with which commands please?
You need to use private-vlans. Private vlans are used in a case where devices on the same subnet and vlan need to be separated from one another. For example in a hotel floor you may have devices in each room in the same vlan but you don't want one guest to sniff other guest's traffic.
To acheive this you need private-vlans consisting of two communities.
Private-vlans is composed of primary and secondary members. Promiscuous will be member of primary vlan but isolated and community will be member of secondary.
Members of same community can talk to each other but not to different communities.
Members of isolated vlan cannot talk to other isolated vlans or communities.
But both community and isolated can talk to the promiscuous which is the port that is connected to the router.
You need to put pc2 & pc3 in one community and pc1 & 4 in another community. So each pair will be able to communicate between with one another but not with the other community members.
To visually illustrate it
vlan 1000
2001 - community - pc1 & pc4 should be here.
2002 - community - pc2 & pc3 should be here.
Hope it made sense to you.
You can read more about private vlans here: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs.html#42874
You can do this with private VLANs if your switch supports it.
Create a community secondary VLAN which contains pc2 and pc3
Create another community secondary VLAN which contains pc1 and pc4
Community VLAN members can only speak to each other and any promiscuous ports
All 4 hosts should be members of the same primary VLAN
If you have a router that the hosts need to speak to, you can configure the router port on the switch as a promiscuous port (any member of the private VLAN can speak to this port)
See this article for further details:
Another option (if your switch supports it) is VLAN ACLs. VACLs are applied to all bridged traffic within a VLAN. See the following for further details:
If it is a layer 2 switch, you will need to set up a router (router on a stick) using sub interfaces and trunking. If it is a layer 3 switch, you can set up routing on that and leave out the router. Search for “router on a stick” commands.
