• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 361
  • Last Modified:

Isolating subnet

I have a stacked cisco 3750X as our main layer3 distribution switch.
It has about a dozen vlans defined. We'd like to isolate one subnet for use in our public conference rooms & common areas. This vlan will be trunked to multiple access layer switches.

The isolated subnet will be 10.32.41.0/24. This subnet should be able to get out to the internet but not be able to hit anything on the internal network except for DHCP & DNS - 10.32.0.13 & 10.32.0.10 (ideally).

What's the best way to implement this?
I'm concerned if we do private vlans I may need to reconfigure all other vlans to be promiscuous? I still want all vlans to be able to communicate with each other except the 41.
0
Rally_IT
Asked:
Rally_IT
2 Solutions
 
MattCommented:
You should create inbound and outbound access list, attached to this VLAN for subnet 10.32.41.0/24.

Inbound should permit only dhcp traffic, outbound dhcp request (any to dhcp server - you can't fix this on ip address because client wil not get ip address until the contact with DHCP server is established), outbound deny to all private networks, at the end of the outbound list "permit ip 10.32.41.0/24 any".

You create ACL on L3 switch, in your case 3750. For access switches on L2 you don't need to do anything.
0
 
PredragNetwork EngineerCommented:
0
 
rauenpcCommented:
Another way to handle it is to make the public vlan a layer 2 only vlan on the switches. Have that layer 2 vlan dump into your firewall. From there, it is up to your firewall to provide DHCP/DNS or at least allow access to those resources. As long as the firewall is the only layer 3 network device on that vlan, public users won't have a way to get at your internal network.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now