VLAN When to Deploy?

[VLADY218]

We have a project coming up. 1 Student Lab (30 PC's) and 30 Staff Members. Students and Staff must have NO access to each other, and only be able to access the same router for internet and a single Server for Active Directory. Is this where a VLAN comes into play and if so will both VLANS be able to log into the server once set up.

Thanks for all your help I've never done this before and looking for some outlooks.

Thanks

 

[baddos]

You can do this with one vlan and protected ports. Make every port protected except the port connecting to the router.

 

[NetEng631]

What type of switches do you have?

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a0080094830.shtml

The following is a matrix of switches and IOS that support private ports.

You would configure the router and the AD server as promiscius ports and the rest as isolated.

Baddos,
I have not implimented or tested private ports on a switch yet. So I'm curious, the documentation states they only limit l2. How would you limit the PC's talking to each other through the router (l3). When the PC doesn't find the other PC it will go to the router. Would the router forward the traffic through it? It would see an IP packet coming in from the switch, it would check the IP Address and send it back to the switch. Am I missing something. Would you need an ACL on the router to prevent this? If so what would it be? Or could you use a VACLS. Interesting problem.

NetEng

 

[baddos]

It wouldn't protect them from accessing something on the other side of the router. You would create an access-list on the router for that.