I'm configuring a Cisco router C1111-8p using IOS XE 16.8 with 3 VLANs.
- VLAN 1: native/management 192.168.0.0/24
- VLAN 10 : 192.168.10.0/24
- VLAN 20 : 192.168.20.0/24
I haven't set ACLs up yet but basically:
- I'd like to block everything but 2ports from outside and these 2 ports will be connected to VLAN 10 only.
- VLAN 10,20 can communicate to each other.
- Management/Native VLAN 1: Nobody should be able to access it but the Wireless AP for eap-tls management and Radius server.
- Connected to VLAN10, either from
GigabitEthernet 0/1/2. Why can I manually define my IP as a VLAN1 or VLAN10's IP?
- Why can I literally obtain legally a different VLAN/subnet's IP than the one I'm connected to?
Wanting inter-VLANs communication doesn't mean I want my device be able to obtain an IP from a different VLAN/subnet.
In that case, there is a huge security weakness because someone in my network can obtain a management IP.
# Setup ISP internet connection configure terminal interface GigabitEthernet 0/0/0 description WAN ip address 219.*.*.* 255.255.255.252 ip nat outside no shutdown end conf t ip nat inside source list NAT interface GigabitEthernet0/0/0 overload ip route 0.0.0.0 0.0.0.0 219.*.*.* ip dns server ip domain-lookup ip name-server 220.127.116.11 18.104.22.168 end # Set DHCP pools configure terminal service dhcp # Native pool ip dhcp pool vlanNativePool network 192.168.0.0 255.255.255.0 default-router 192.168.0.1 exit # VLAN 10 pool ip dhcp pool vlan10Pool network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 22.214.171.124 126.96.36.199 # VLAN 20 pool ip dhcp pool vlan20Pool network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 188.8.131.52 184.108.40.206 end #NAT configure terminal ip access-list standard NAT permit 192.168.10.0 0.0.0.255 permit 192.168.20.0 0.0.0.255 permit 192.168.0.0 0.0.0.255 end #Setup the trunk port between the switch and the WAP configure terminal interface GigabitEthernet 0/1/0 switchport mode trunk switchport trunk native vlan 1 switchport trunk allowed vlan add 1,10,20 switchport nonegotiate no shutdown end #Setup the port VLAN 1 native for the Radius/squid server configure terminal interface GigabitEthernet 0/1/6 switchport mode access switchport access vlan 1 no shutdown exit #Setup the port VLAN 1 for management configure terminal interface GigabitEthernet 0/1/7 switchport mode access switchport access vlan 1 no shutdown end # Setup the switch port for direct VLAN access configure terminal interface GigabitEthernet 0/1/2 switchport mode access switchport access vlan 10 no shutdown exit interface GigabitEthernet 0/1/3 switchport mode access switchport access vlan 20 no shutdown exit # Configure VLANs ip routing configure terminal # VLAN 1 DEFAULT NATIVE vlan 1 interface vlan 1 ip address 192.168.0.1 255.255.255.0 ip nat inside exit # VLAN 10 vlan 10 no shutdown interface vlan 10 ip address 192.168.10.1 255.255.255.0 ip nat inside no shutdown exit # VLAN 20 vlan 20 no shutdown interface vlan 20 ip address 192.168.20.1 255.255.255.0 ip nat inside no shutdown end