We have two Catalyst 3560 switches with multiple vlans all with assigned IP addresses and InterVLAN routing established. The two switches are trunked. The IP address of each vlan is the default gateway for hosts on that vlan. Vlan maps are used to isolate some traffic between vlans. However, were having a heck of a time figuring out how to assure no vlan except VLAN 1 can access the Management CLI. Basically, as we understand it, on a Catalyst 3560, the management vlan is on VLAN 1 and it cannot be changed. However, were seeing a connection to the management CLI can be established from any of the vlans by connecting to their default gateway. Is there a way to block other vlans from having this CLI access?
An example of the scenario is this:
--------------------------
----------
----------
--
ip routing
interface Vlan1
description ManagementVlan
ip address 192.168.10.1 255.255.255.0
no ip mroute-cache
!
interface Vlan2
description LanVlan
ip address 192.168.20.1 255.255.255.0
ip pim sparse-dense-mode
!
interface Vlan3
description iLoVlan
ip address 192.168.15.1 255.255.255.0
no ip mroute-cache
--------------------------
----------
----------
--
Here, clients on VLAN 2 or 3 can connect to the management CLI at their respective gateway IPs, 192.168.20.1 and 192.168.15.1, respectively. Even if vlan maps and/or routing ACLs are used to block traffic to the management vlan IPs, clients on VLANs 2 or 3 can still connect to the management CLI.
Here is the trunk configuration:
--------------------------
----------
----------
--
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
interface GigabitEthernet0/49
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode desirable
--------------------------
----------
----------
--
Start Free Trial
