How to segment the traffic by using VLANs on Cisco 3560 switch?

Balack
Balack used Ask the Experts™
on
The is my partner's company, that make fully use on cisco switches. Assumed that they are using distribution and access layers hierrachy, now there is a request to create one new additional segment, how should I do the control on traffic in/out from this segment?

Off course I'll use VLAN, should I use ACL to control traffic? Does ACL support VLANs? and how?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
You have 2 types of port configurations.  Layer 2 and Layer 3.  

A switchport is layer 2 and where VLAN's generally operate, so no, ACL's don't apply.

Typically a layer 3 port is the port connected to your internet connection, where you maybe routing multiple vlans out...  ACL's would work on Layer 3 routed ports.

What exactly are you trying to do?

Author

Commented:
Hi adam1115,

The objective is to permit/deny traffic between local host and remote hosts. For example, if I am going to deploy a mail server in vlan A; only few of the hosts in vlan B are allowed to access this mail server, by using smtp ONLY; How am  I able to achieve this objective?
OWASP: Threats Fundamentals

Learn the top ten threats that are present in modern web-application development and how to protect your business from them.

Head of IT Security Division
Top Expert 2010
Commented:
Hi,

If you want to totaly separate this new VLAN please use VRF-lite, it bulids virtual routing tables, so you win maximum security.....

Sure, you can implement this with vrf-lite:
http://networkers-online.com/blog/2009/02/vrf-lite/ 
http://packetlife.net/blog/2009/apr/30/intro-vrf-lite/

Don't forget this features enabled on EI images only!

Best regards,
Istvan

Author

Commented:
Does vrf is a cisco method?

Author

Commented:
If possible, prefer Cisco official method.

Author

Commented:
Looks good, but it may not suitable in my working environment

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial