Isolating subnet

Posted on 2014-08-14
Last Modified: 2014-08-19
I have a stacked cisco 3750X as our main layer3 distribution switch.
It has about a dozen vlans defined. We'd like to isolate one subnet for use in our public conference rooms & common areas. This vlan will be trunked to multiple access layer switches.

The isolated subnet will be This subnet should be able to get out to the internet but not be able to hit anything on the internal network except for DHCP & DNS - & (ideally).

What's the best way to implement this?
I'm concerned if we do private vlans I may need to reconfigure all other vlans to be promiscuous? I still want all vlans to be able to communicate with each other except the 41.
Question by:Rally_IT
    LVL 6

    Accepted Solution

    You should create inbound and outbound access list, attached to this VLAN for subnet

    Inbound should permit only dhcp traffic, outbound dhcp request (any to dhcp server - you can't fix this on ip address because client wil not get ip address until the contact with DHCP server is established), outbound deny to all private networks, at the end of the outbound list "permit ip any".

    You create ACL on L3 switch, in your case 3750. For access switches on L2 you don't need to do anything.
    LVL 25

    Expert Comment

    by:Predrag Jovic
    LVL 20

    Assisted Solution

    Another way to handle it is to make the public vlan a layer 2 only vlan on the switches. Have that layer 2 vlan dump into your firewall. From there, it is up to your firewall to provide DHCP/DNS or at least allow access to those resources. As long as the firewall is the only layer 3 network device on that vlan, public users won't have a way to get at your internal network.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
    Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now