new VLAN

[raoul2341]

Hi

I recently got involved in the configuration of cisco switches and I have to configure a new switch for a different vlan. All existing devices are on Vlan1. Here is my question please:

I have a set of new PCs/Servers that need to be on a seperate VLAN e.g vlan 20. These devices should not be accessed by any other device outside of this Vlan but they can access one server on Vlan 1. This is what I have done:

1. Created new vlan 20 and interface vlan 20 on a layer3 switch. The routing on the layer 3 switch is set to route everything through the layer 3 switch (route 0.0.0.0 0.0.0.0 192.168.20.1).

2. On the new switch, I assigned an ip address in the .20.XX range and moved all the ports to vlan 20.

3. Assigned the new Pcs/servers static ip addresses in the same range.

It is all working but devices on Vlan1 can see the new devices on vlan20.

Your help is greatly appreciated.

Thanks

 

[baddos]

You need the devices on vlan1 to have their default gateway set to the layer 3 switch if they aren't already. You would then control the filtering via an access list to ensure that only that one server has access to vlan20 hosts.

 

[vipergg]

Just create a inbound acl on the vlan 20 SVI permitting everything in the vlan 20 subnet to go to the one ip in vlan 1 , should be 1 statement . Everything else will be denied by the implicit deny at the end of a ACL.

 

[raoul2341]

Man thanks for your replies. I have never done this before but I am sure I will find lots of info by googling.

Cheers

 

[vipergg]

Just go to cisco.com and do a search , almost all documentation is free of charge.

 

[burtsbees]

ip access-list extended bla
10 permit ip host (vlan1_server_ip_ any
20 deny ip x.x.x.x y.y.y.y
30 permit ip any any
int vlan 20
ip access-group bla in

x.x.x.x=ip subnet of vlan 1, y.y.y.y=wildcard (inverse) mask, i.e. 10.1.1.0 255.255.255.0=

20 deny ip 10.1.1.0 0.0.0.255 any

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!