is private Vlan concept is introduced by cisco for alternative for access-list to segregate traffic among different Vlan and within same Vlan .
1
-
Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.– Ron Maupin ♦Dec 23, 2021 at 17:37
Add a comment
|
1 Answer
It might.
A private VLAN (or port isolation) restricts communication between switch ports. Normally, that is used to enable their communication to a server or uplink port while denying all other ports. Since a private VLAN is port-based it is essentially a layer-2 concept. Your trust is based on physical switch ports.
An access list can be used to filter traffic based on IP addresses (layer 3) or transport-layer port numbers (layer 4). An ACL is much more flexible than a private VLAN - you could for instance restrict traffic to DNS queries to one IP destination and HTTP to a range of destinations that are remote to the filtering switch. However, your trust is based on IP addresses. Since those might be spoofed, ACLs may require additional policies (DHCP snooping, MAC-IP binding, 802.1X, ...) to ensure the required security.
Whatever you use depends on your requirements and where you can base your trust.