Cisco switch inter-vlan access

Question

I have Cisco Catalyst 2960-s switch and I want to configure three Vlans (A; B; C)

I want to :

• Allow traffic between A and B
• Allow traffic between A and C
• Block traffic between C and B

or if there is other method to permit/deny access between switch ports.

Answer 1

You might try to look onto private VLANs - though they are only available on the more expensive switches and not 2960 :-(

Answer 2

This can be done with access control lists. I believe their 2960 switches an only put them on ingress, but that should be enough to do what you are asking.

1. Make ACL
2. Apply to SVI

http://www.networkclue.com/routing/Cisco/access-lists/index.aspx

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#topic1

Answer 3

OK Catalyst 2960-s doesn't have routing possibility.

But it has another great feature called protected port : two protected ports can not communicate with each other.

I used this feature to divide my network into four segments (see image below) :

• user group1 is on protected port
• user group2 is on protected port
• server group is on protected port
• shared resources are on non protected ports

this does exactly what i wanted to do, but i'm afraid that having all users on a single port will decrease network performance??

in other words, what happens if all users in user group 1 demand access to shared resources?