Using a VLAN to Completely Isolate Devices from the Internet & Other VLANs

Question

I have a Cisco SG350-10P Managed Switch, and currently have two VLANS on it, the default VLAN 1 and VLAN 10. I want devices connected to VLAN 10 to have no ability to communicate with the internet or any other VLANs on the switch. In other words, I want to ensure that the only thing these devices can communicate with or discover are other hosts on VLAN 10.

Currently what I've done is made sure that VLAN 10 doesnot participate in the trunk port, and setting all ports that are part of the VLAN as Access Ports. I connected a Ubuntu machine to one of the ports and when I try pinging any public address (e.g. 8.8.8.8) or any devices on VLAN 1 I get host unreachable which is what I'm after.

So basically, my question is if this is sufficient to ensure that devices on VLAN 10 can't communicate beyond the VLAN? I am quite new to VLANs, but as I understand it removing the VLAN from the trunk port means that the switch has no way of sending the packets out of the VLAN.

My apologies if this is a duplicate and thanks for your time.

Answer 1

I want devices connected to VLAN 10 to have no ability to communicate with the internet or any other VLANs on the switch.

Simply do not connect a router to that VLAN. Each VLAN is a contained link-layer segment and without a router, that VLAN can't communicate with anything outside.

You can still trunk the VLAN across multiple switches without a problem.

Answer 2

Instead of removing vlan10 from trunk port . Allow vlan 10 on trunk port and exclude vlan 10 subnet from NAT overload configuration and access-list configuration...

To isolate traffic between vlan 10 and other vlan access -list can been configured in router .