0

I have a Cisco SG350-10P Managed Switch, and currently have two VLANS on it, the default VLAN 1 and VLAN 10. I want devices connected to VLAN 10 to have no ability to communicate with the internet or any other VLANs on the switch. In other words, I want to ensure that the only thing these devices can communicate with or discover are other hosts on VLAN 10.

Currently what I've done is made sure that VLAN 10 doesnot participate in the trunk port, and setting all ports that are part of the VLAN as Access Ports. I connected a Ubuntu machine to one of the ports and when I try pinging any public address (e.g. 8.8.8.8) or any devices on VLAN 1 I get host unreachable which is what I'm after.

So basically, my question is if this is sufficient to ensure that devices on VLAN 10 can't communicate beyond the VLAN? I am quite new to VLANs, but as I understand it removing the VLAN from the trunk port means that the switch has no way of sending the packets out of the VLAN.

My apologies if this is a duplicate and thanks for your time.

2 Answers 2

0

I want devices connected to VLAN 10 to have no ability to communicate with the internet or any other VLANs on the switch.

Simply do not connect a router to that VLAN. Each VLAN is a contained link-layer segment and without a router, that VLAN can't communicate with anything outside.

You can still trunk the VLAN across multiple switches without a problem.

0

Instead of removing vlan10 from trunk port . Allow vlan 10 on trunk port and exclude vlan 10 subnet from NAT overload configuration and access-list configuration...

To isolate traffic between vlan 10 and other vlan access -list can been configured in router .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.