Security between VLANS on 3560's

ciscopower · ‎04-13-2007

Hi Experts,

Hopefully you can help me out with this issue. I have dual 3560 switches providing intervlan routing functions for a few vlans, including one VLAN for connection to an ASA and one VLAN for Guest Wireless Access.

Basically, what i want to do is limit access to the Guest VLAN 4 so that it can only access the ASA Vlan 2 to get internet access and not be able to communicate with other vlans. There is a DHCP server in Vlan 101 so access is needed for this, we are also running HSRP and OSPF so these need to be not blocked. Can anybody help me with an access list config??? Attached is the show run form one of the switches.

Many Thanks.

Phil

Edison Ortiz · ‎04-14-2007

I recommend going with private vlans.

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225see/scg/swpvlan.htm

dbellaze · ‎04-14-2007

I don't think you need to implement private VLANs. You could also configure your 3560's as DHCP servers for the guest network so you do not have to allow anything into your internal network. Unless you have a layer three device inside the guest network that you need to share routing information with I would suggest marking the guest network interfaces passive for OSPF.

Below is an example of the configuration you could apply to your 3560's.

Assume the following info for the example.

HSRP Address 192.168.1.1

Primary 3560 192.168.1.2

Secondary 3560 192.168.1.3

DHCP Server 10.0.0.100

DNS Server 10.0.0.101 (just in case)

Line 1 allows OSPF and HSRP.

Lines 2 and 3 allow ICMP to your routers and HSRP address.

Line 4 permits DHCP requests

Line 5 permits DNS requests (just in case)

Lines 96, 97, and 98 deny the guest network to any RFC 1918 addresses. If you are not using RFC 1918 addresses internally or you have public DMZ's you will need to add statements for those in the ACL.

Line 99 allows the guest network to the internet.

The

Primary 3560 -

ip access-list extended guest_acl

1 permit ip host 192.168.1.3 224.0.0.0 0.0.0.255

2 permit icmp any 192.168.1.0 0.0.0.3 echo

3 permit icmp any 192.168.1.0 0.0.0.3 echo-reply

4 permit udp any host 10.0.0.100 eq 67

5 permit udp any host 10.0.0.101 eq 53

96 deny ip any 10.0.0.0 0.255.255.255

97 deny ip any 172.16.0.0 0.15.255.255

98 deny ip any 192.168.0.0 0.0.255.255

99 permit ip any any

interface vlan 4

desc Guest

ip access-group guest_acl in

Secondary 3560 -