5
Since you want to permit WAN traffic, matching only any, you need to have a permit any any at the end.
Basically, you want to deny traffic in and out of the Wi-Fi VLAN. For each of the other VLANs you need a
deny ip 10.0.240.0 0.0.0.255 <otherSubnet> <subnetWildcard>
on the incoming interface or the VLAN of the wireless subnet and
deny ip <...
3
It does not matter, but leaving gaps between enumerated things, e.g. ACL lines, is a good practice, and people often carry that over to other things.
You may want to leave room to add logically related VLANs to be in the same range of 10 to 19. For example, if you have department VLAN numbering, and a department that uses VLAN 10 for its data wants to add a ...
2
Not really an official best practice, and I know this is primarily opinion (which is frowned upon here) but, like Ron said already, leaving space between VLAN IDs allows for better grouping of similar types of devices and such.
Additionally, matching the VLAN IDs to the third octet of an IPv4 network makes it easy to keep track of which VLAN is associated ...
2
When you create a VLAN, you split your switch into separate logical devices, each serving its dedicated network segment. They behave exactly like separate, unconnected physical devices; no traffic can be forwarded from one VLAN to another - that's the entire purpose of VLANs. Each network segment must be its own separate subnet, i.e. devices connected to ...
1
Thought it might be beneficial to others to expand @Ron Maupin's comment to an actual answer.
What happens with the stated configuration is as follows:
A guest connects to VLAN 30 in Branch network and broadcasts a DHCP Discover packet
Branch switch floods the Disc packet
Brand router receives it, and as instructed by the IP Helper config forwards the ...
1
On Cisco devices, SVI's are configured just like a physical interface. They are named for the vlan they're attached to.
For example, the SVI for Vlan 10 is named interface vlan10. To assign an IPv4 address to it, you would type:
interface vlan10
ip address 192.0.2.1 255.255.255.0
1
An SVI is a Switched Virtual Interface. It is an interface for the VLAN itself on the switch. It can be a layer-3 interface (IP addressing) to allow the switch itself to participate in the VLAN.
A layer-2 switch can use a layer-3 SVI as its management interface, and it would also need a default gateway in the VLAN to allow the management interface to be ...
Only top voted, non community-wiki answers of a minimum length are eligible