You can create a new vlans(s) to support the new tenants and even create a routed interface for them on your 6500. You are right that the L3 switch will see those vlans as directly conencted routes and route between them, but you can create extended access lists segregate that vlan's traffic.
Assume the new subnet you create is 10.10.1.0/24
And assume also that subnets 10.10.2.0/24 and 10.10.3.0/24 are part of your existing production environment.
You can do the following:
ip access-list extended SEGREGATE_VLAN
deny ip 10.10.1.0 0.0.0.255 10.10.2.0 0.0.0.255
deny ip 10.10.1.0 0.0.0.255 10.10.3.0 0.0.0.255
permit ip 10.10.1.0 0.0.0.255 any
ip address 10.10.1.0 255.255.255.0
ip access-group SEGREGATE_VLAN out
An access-list applied outbound to a vlan interface is traffic going TO machines on that vlan.
An access-list applied inbound to a vlan is traffic coming FROM machines on that vlan.
We are pleased to announce availability of Beta software for 16.6.3.
16.6.3 will be the second rebuild on the 16.6 release train targeted
towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are
looking for early feedback from customers befor...
Introduction Featured Speakers Luis Espejel is the Telecommunications
Manager of IENova, an Oil & Gas company. Currently he works with Cisco
IOS® and Cisco IOS XE platforms, and NX to some extent. He has also
worked as a Senior Engineer with the Routing P...
In this session you can learn more about Layer 3 multicast and the best
practices to identify possible threats and take security measures. It
provides an overview of basic multicast, the best security practices for
use of this technology, and recommendati...