Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

VLAN - Intenet Access Only

I have a cisco 3750 switch. It currently has 2 vlans on it. I would like to be able to provide internet only access from this switch to a meeting room. What is the easiest and most ssecure way to do this? Thank you.

3 REPLIES
New Member

Re: VLAN - Intenet Access Only

You would create an additional VLAN and then apply an access list on the VLAN interface that precludes traffic except to the internet. Let's assume you have created VLAN 20 and want to use that as your Internet only VLAN. The example below allows for the client to obtain a dhcp address and to use dns services internally. You then block access to all RFC 1918 (private) addresses, assuming that's what you are using internally. The helper-address is for DHCP.

interface Vlan20

ip address 10.2.20.1 255.255.255.0

ip access-group guest in

ip helper-address 10.1.1.1

ip access-list extended guest

permit udp any any eq bootps

permit udp any any eq bootpc

permit udp 10.196.20.0 0.0.0.255 host 172.29.1.1 eq domain

permit udp 10.196.20.0 0.0.0.255 host 172.29.1.2 eq domain

deny ip 10.196.20.0 0.0.0.255 172.16.0.0 0.15.255.255

deny ip 10.196.20.0 0.0.0.255 192.168.0.0 0.0.255.255

deny ip 10.196.20.0 0.0.0.255 10.0.0.0 0.255.255.255

permit tcp 10.196.20.0 0.0.0.255 any

deny ip any any log

New Member

Re: VLAN - Intenet Access Only

I was assuming you were doing layer 3 on the switches; if not you would apply the access-list to the interface/sub-interface on the router.

Silver

Re: VLAN - Intenet Access Only

Another simple approach would be to create an Internet-Only 3rd VLAN. Keep this VLAN Layer2, no Layer3 switching. Connect this VLAN to a DMZ port on your firewall. Configure the firewall such that the DMZ is only allowed internet access, no access from or to the Internal network.

You will need to provide a DHCP server for this VLAN.

Please rate all helpful posts.

Regards,

Brad

192
Views
4
Helpful
3
Replies
CreatePlease to create content