3

In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*.

There are two core switches, Dell S4048-ON (bundled OS), with servers attached, and other "edge" switches connected to the clients. One pair of edge switches are connected with a loop configuration, for high availability (unrelated to this). network diagram

I have solved it inside any of the "edge" switches, which are HP 2920 and 2810:

filter source-port named-filter "uplink-only" drop 1-44
filter source-port 1-44 named-filter "uplink-only"

However, the client VLAN (VLAN 3) is available on the uplink to the core routers. So the intra-VLAN packets will appear on the other edge switches.

The core switches are currently configured without ACL, simply routing between VLAN 1 and 3.

The question is then how to implement an ACL for the Core switches to prevent forwarding packets within VLAN 3 -- but allow routed traffic from that VLAN. For redundancy purposes, it is necessary to forward VLAN1 between ports as is done now, allowing a link do go down in the redundantly configured swithces. Also, DHCP must be available to the clients, from another server on VLAN 1, using the "ip helper-address" option.

Alternative solutions to the general problem of blocking traffic between clients are of course welcome.

*The reason is to improve security when the client devices may not always be configured securely.

  • I do not know if your switches have this, but Cisco has the Private VLANs that can only communicate with an uplink. That seems to be what you want. The problem is that layer-2 is designed as peer-to-peer. Also, I would eliminate any access switch connections to other access switches. Just have the access switch connect to both distribution switches for HA. The current best practices say to have a VLAN only on one access switch (the switch can have multiple VLANs, but they do not exist on other access switches), and access switches do not connect to other access switches. – Ron Maupin Mar 19 at 15:52
  • Please include the switch models in your question - HPE switches differ quite a bit. – Zac67 Mar 19 at 15:55
  • This answer explains about the best practices for access switch topology. Following the recommendations will prevent many layer-2 problems. We now live in a layer-3 world, and there really is no reason to have hosts on different switches connected to the same VLAN because things that require hosts to be on the same layer-2 LAN are really extinct. – Ron Maupin Mar 19 at 22:40
3

Since your clients are connected by the edge switches you'll need to filter unwanted traffic there - before the core switches.

How exactly that can be done depends on the models/series you use.

With current models (2530 or so) you could apply an ACL to the VLAN to stop inter-VLAN communication. E.g. for 192.168.3.0/24 in VLAN 3:

ip access-list extended no3
100 deny ip 192.168.3.0/24 192.168.3.0/24
999 permit any any
exit
vlan 3 ip access-group no3 vlan-in

If you need to disable manually changed IP addresses only you could either force DHCP-assigned addresses only (dhcp-snooping) or allow only proper traffic:

ip access-list extended no3
100 deny ip 192.168.3.0/24 192.168.3.0/24
110 permit ip 192.168.3.0/24 any
120 permit ip any 192.168.3.0/24
999 deny any any
exit
vlan 3 ip access-group no3 vlan-in

Obviously, this is for IPv4 only, IPv6 needs an ACL of its own.

filter source-port works intra-switch only, so you'd need the same function in the core switch as you've discovered. (Alternatively, you can split the L2 segments as Ron M.'s comment suggests.)

[edit]

2920 and 2810 switches series don't support VLAN ACLs yet, so you need to apply them to each edge port: interface <n> access-group no3 in. Generally, you should filter unwanted traffic as soon as possible = on the edge switches.

  • This method works on the 2920 (in the edit). The ancient 2810 doesn't even have IP ACLs. There is possibly some issues with DHCP negotiation. It also allows broadcast traffic. I may try to split the L2 segments. Comprehensive and good answer, giving many ideas for how to solve this. – Marius Bjørnstad Mar 26 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.