Hello,

I am trying to isolate a vlan interface in order to dedicate it for management.

I tried to isolate it (at layer 3) using route-map :

my admin net is 1.0.0.0/24 (int vlan 945)

my operation net is 2.0.0.0/24 (int vlan 8)

ip access-list standard allow_1_0_0_0

permit 1.0.0.0 0.0.0.255

deny any

exit

ip access-list standard allow_all

permit any

exit

route-map deny_routing_to_1_0_0_0 deny

match ip address allow_1_0_0_0

set interface Null 0

exit

route-map deny_routing_to_anywhere deny

match ip address allow_all

set interface Null 0

exit

int Vlan945

ip address 1.0.0.2 255.255.255.0

ip policy route-map deny_routing_to_anywhere

int Vlan8

ip address 2.0.0.2 255.255.255.0

ip policy route-map deny_routing_to_1_0_0_0

It seems pretty clean to me (cleaner than using ACLs ?), put the problem is that "set interface 0" is not supported on the 3560g.

I tried using a loopback with an ip in the range 127.0.0.0, and using set ip next-hop but that's not possible either.

Is it possible to do what I am tring to do without using ACLs directly in an vlan interface ?

Thanks

Best regards

Guillaume