We have new gen aruba (hpe) switches in our environment.
There is a backbone (5412R zl2) which all edge switches are connected to. The edge switches are also layer 3 (2930F). The backbone delivers traffic to our firewall for internet and other reasons.
We added new vlans for our domain network (vlan10,20,30). We want these vlans to talk to each other so we enabled ip routing and gave each vlan an ip address. Then we routed each vlan to the firewall gateway with a static route. Basically intervlan is working via SVI. There is no problem here. (We want the intervlan traffic managed by the backbone!)
On the other hand we have a switch management vlan (vlan3) where all of our switches (management IPs) are located. We do not want this vlan to be a part of the intervlan (svi) mentioned above. We want this vlan (3) to be controlled via router on a stick. The stick would be our firewall. The reason being we would like to control who can access the management vlan on our firewall using user/computer objects.
How can I exclude vlan 3 from being a part of the ongoing (L3/SVI) intervlan?
TLDR; VLAN10,20,30 should talk to each other directly on the (backbone) switch level.
But this shouldn't apply for vlan 3. vlan 3 should be configured as a router on a stick (via firewall).
example config; (IPs ending with 254 are firewall gateway interfaces)
ip route 0.0.0.0 0.0.0.0 192.168.3.254 ip route 0.0.0.0 0.0.0.0 192.168.10.254 ip route 0.0.0.0 0.0.0.0 192.168.20.254 ip route 0.0.0.0 0.0.0.0 192.168.30.254 ip routing vlan 3 name mgmt untagged xxx tagged xxx ip address 192.168.3.1 255.255.255.0 vlan 10 name floor1 untagged xxx tagged xxx ip address 192.168.10.1 255.255.255.0 vlan 20 name floor2 untagged xxx tagged xxx ip address 192.168.20.1 255.255.255.0 vlan 30 name floor3 untagged xxx tagged xxx ip address 192.168.30.1 255.255.255.0
if I can't find a solution I will have to go with ACLs on the backbone. Which is something we don't prefer for this situation.