12-03-2007 01:09 PM - edited 03-05-2019 07:47 PM
I have a specific server in my LAN that I need to restrict so only certain IPs can access it. I am contemplating creating a VLAN on the switch and putting the server in that VLAN. Then, using a router-on-a-stick, route between the two VLANs. Does that sound like a feasible solution? Could I then use an inbound access list on the router to limit access to only the specific IPs between the VLANs?
12-03-2007 01:14 PM
Hi
Yes that sounds perfectly feasible assuming you do not have a L3 switch. As long as your router supports 802.1q encapsulation and ditto your switch this would be fine.
You could use an inbound access-list on the non-server vlan interface or an outbound access-list on the server vlan inteface.
HTH
Jon
12-03-2007 01:28 PM
I am using a Catalyst 3548 Switch and a 2600 series router and I am assuming that they will do this.
Above it was stated: "You could use an inbound access-list on the non-server vlan interface or an outbound access-list on the server vlan inteface." Isn't that backwards? Say I create VLAN 20 and place this single server on it. Since I'm filtering IPs coming into VLAN 20 to access this server wouldn't I apply the access list restrictions inbound on the VLAN 20 interface?
12-03-2007 01:32 PM
Hi
Yes 3548 and 2600 router will do fine. You need to make sure you have an IOS on the router that supports 802.1q.
If the server vlan is vlan 20 -
traffic coming into that vlan interface is traffic coming from the server on vlan 20 going out to anywhere else.
traffic going out on the vlan 20 interface is traffic going to the server in vlan 20.
Jon
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: