Restrict Guest Vlan to internal network
Posted on 2014-10-28
I have a customer that they have exciting router and data Vlans. The switch is Cisco linksys SG500 Layer 3 switch.
They want to add one more restricted Guest Vlan and following is their setup.
Main Router IP - 192.168.0.1/24
Switch: Data Vlan1 - 192.168.0.0/24 and Vlan 2: 172.16.0.0/24 ( Vlan 1 and 2 can talk to each other)
Add one more Guest Vlan as 10.0.0.0/24 .
Since it is layer 3 switch, I can add 10.0.0.0/24 Vlan 3 to their exciting network and it can go to internet but how I can restrict Vlan 3(Guest) to deny access to Vlan 1 and 2 ?
If I create access-list for Vlan 3 that deny access to 192.168.0.0, it won't be able to go to internet.
And they cannot change their exciting Data Vlan 1 network subnet .
How to make this work ? Any suggestion ?