Can all VLANs be allowed to communicate with a router but not between VLANs?
If it is possible, then how to achieve it?
The VLANs and router are in the same subnet.
I have topology like this:
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Dec 17, 2020 at 17:18
3 Answers
Yes, that's kinda the point of having VLAN in the first place: to segregate group of devices in different networks to handle them differently (and improve performance by creating separate broadcast domains).
By default a router... ...route, between all connected networks (including VLAN). So if all VLAN are connected to the same router, then without further config, they will communicate together.
So we add firewall rules on the router to filter which communication can occur between which VLAN/hosts.
You will often find the term acl
that stand for access control list
which is the name of those firewall rules in Cisco devices.
acl
is now, by usage, pretty much a standard term used even when referring to non-cisco devices, but terminology may vary by user and equipment. Still the principle hold, and any decent router (end even most enterprise-class switches) has this feature.
In addition to JFL's answer:
The VLANs and router are in the same subnet.
The router needs to have an interface with a matching IP address in each VLAN/subnet - VLAN:subnet mappings are usually 1:1. Subnets must not overlap (or even match each other).
Using the same subnet across all VLANs cannot work ever.
Yes it feasible . Configure inter - vlan routing in router . Create sub-interface for each vlan assigning each subnet to each vlan and connect router and switch . Switch must be in trunk link allowing all vlan from router towards switch . Further in switch create all vlans and further pass required Vlans and switch port which are connected to PCs
Hence all traffic from all vlans will reach router because gateway of vlans are in router
Further to isolate traffic among VLANs Access-list need to configure