Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

SECURING VLANS/NETWORKS

We have a hospital network consisting of a class C ip addresses per

floor. We are running layer 3 to the access switches 3750's and 6500's.

I recently cut up a separate class C network to /27 addresses and am using five

of the /27 networks on different floors of the hospital.  Problem now is I found that

these networks for security reasons should not be able to see any other networks.

They only need to see each other.

I am just looking for suggestions on the best and easiest way to do this...

PVLANS or Access list or anything else????

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: SECURING VLANS/NETWORKS

ppellettiere wrote:

All the devices on all  5 /27 networks need to be able to see each other. They cannot

see any other networks.

Okay then using acls on the vL3 vlan interfaces would be the way to go eg.

vlan 10 = 192.168.5.0 255.255.255.224 ie. /27

vthe other 4 vlans go up from where vlan 10 left off eg. vlan 11 = 192.168.5.32/27, vlan 12 = 192.168.5.64/27

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.32 0.0.0.31

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.64 0.0.0.31

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.96 0.0.0.31

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.128 0.0.0.31

int vlan 10

ip access-group 101 in

and then repeat for each subnet eg.

access-list 102 permit ip 192.168.5.32 0.0.0.31 192.168.5.0 0.0.0.31

access-list 102 permit ip 192.168.5.32 0.0.0.31 192.168.5.64 0.0.0.31

etc..

int vlan 11

ip access-group 102 in

Also there is an implict deny at the end of each access-list so you don't need to add the line "access-list 101 deny ip 192.168.5.0 0.0.0.31 any". However you can if you want to see how many hits are being denied.

Jon

4 REPLIES
Hall of Fame Super Blue

Re: SECURING VLANS/NETWORKS

ppellettiere wrote:

We have a hospital network consisting of a class C ip addresses per

floor. We are running layer 3 to the access switches 3750's and 6500's.

I recently cut up a separate class C network to /27 addresses and am using five

of the /27 networks on different floors of the hospital.  Problem now is I found that

these networks for security reasons should not be able to see any other networks.

They only need to see each other.

I am just looking for suggestions on the best and easiest way to do this...

PVLANS or Access list or anything else????

No sure exactly what you mean.

If you mean the new /27 networks should only see themselves ie. a device in a /27 network should only be able to see other devices in the same /27 network then simply don't create a L3 SVI for this vlan on your switch. That way they cannot route to any other vlan.

If you mean you want to restrict access between vlans then L3 acl's applied to the vlan interfaces is the way to go.

If you mean you want to restrict traffic within a vlan then VACLs (vlan access-lists) are what you should use.

Could you clarify exactly what you want ?

Jon

New Member

Re: SECURING VLANS/NETWORKS

All the devices on all  5 /27 networks need to be able to see each other. They cannot

see any other networks.

Hall of Fame Super Blue

Re: SECURING VLANS/NETWORKS

ppellettiere wrote:

All the devices on all  5 /27 networks need to be able to see each other. They cannot

see any other networks.

Okay then using acls on the vL3 vlan interfaces would be the way to go eg.

vlan 10 = 192.168.5.0 255.255.255.224 ie. /27

vthe other 4 vlans go up from where vlan 10 left off eg. vlan 11 = 192.168.5.32/27, vlan 12 = 192.168.5.64/27

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.32 0.0.0.31

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.64 0.0.0.31

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.96 0.0.0.31

access-list 101 permit ip 192.168.5.0 0.0.0.31 192.168.5.128 0.0.0.31

int vlan 10

ip access-group 101 in

and then repeat for each subnet eg.

access-list 102 permit ip 192.168.5.32 0.0.0.31 192.168.5.0 0.0.0.31

access-list 102 permit ip 192.168.5.32 0.0.0.31 192.168.5.64 0.0.0.31

etc..

int vlan 11

ip access-group 102 in

Also there is an implict deny at the end of each access-list so you don't need to add the line "access-list 101 deny ip 192.168.5.0 0.0.0.31 any". However you can if you want to see how many hits are being denied.

Jon

New Member

Re: SECURING VLANS/NETWORKS

WOW you went above and beyond ...Thank You.

279
Views
5
Helpful
4
Replies