0

i have a sw nexus

i have a router BGN with vlan 50 is going to sw then mode access to Client 1 and Client 2

BNG ==== SW1 == PORT1 =Client 1 (Mode access vlan 50)

                PORT2 =Client 2 (Mode access vlan 50

)

the have connected to BNG by pppoe and everything is ok

but the problem is

when Client 1 try to connect to BNG , is send a PADI packet , it's a broadcast , so this packet is going to Client 2 and to BNG Router

i need some filter apply in Port 1 ( outbound) so is just filter Any PADI packet to go to client

so the Port 1 and 2 they just only can send PADI message and not do not receive it it from another Client .

  • What's the switch model? If you can't/don't want to put each client in a different VLAN you need to configure the VLAN as private. How that works depends on the switch features. – Zac67 Apr 16 at 17:55
  • Hello , is nexus 3000 model – Anas Programmer Apr 16 at 17:56
  • Any another idea except pvlan ? ,,, – Anas Programmer Apr 16 at 17:57
  • Without PVLAN your clients can generally talk to one another outside of PPPoE - don't think you'd want that. – Zac67 Apr 16 at 18:35
  • what about Mac access-list with ethertype – Anas Programmer Apr 16 at 19:59
3

What you're looking for is generally called "port isolation". On NX-OS, that's done with private vlans. Yes, at first glance, PVLAN configuration can be confusing, but Cisco has many documented examples. Here is one such document. (old, and ignore that it's for a 7000 and v5_x)

vlan 3
  private-vlan isolated

vlan 2
  private-vlan primary
  private-vlan association 3

! ROUTER PORT
interface ethernet 1/1
  switchport
  switchport mode private-vlan promiscuous

! CLIENT1    
interface ethernet 1/2
  switchport
  switchport mode private-vlan host
  switchport private-vlan host-association 2 3

! CLIENT2
interface ethernet 1/3
  switchport
  switchport mode private-vlan host
  switchport private-vlan host-association 2 3

! Layer-3 interface (optional?)
interface vlan 2
  private-vlan mapping 3

You only need a primary and isolated vlan. The primary vlan carries traffic downstream to the isolated client ports. The isolated vlan carries traffic upstream from the isolated ports. That should prevent traffic between clients. However, broadcast traffic from the router (e1/1) would still be sent to all clients.

MAC filtering could also work, but would require knowing the MACs of all devices at all times. Any change in device would require updating the filters.

| improve this answer | |
  • thank for helping ,but i can use same interface to trunk a normal vlan and Pvlan? – Anas Programmer Apr 17 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.