Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


Internet <----> Hardware firewall/router <----> Cisco Catalyst 3560 switch (2 VLANs)

What is the best way to restrict traffic between servers within the same VLAN? Can I create ACL's on our switch for this?

Any advice would be appreciated.

share|improve this question
Use firewalls on both machines. – SpacemanSpiff Dec 14 '10 at 22:12
up vote 3 down vote accepted

With private vlans (pvlans) you can prevent hosts talking to each other even if they're in the same VLAN. There are extensive docs in the Cisco website :-)

share|improve this answer

I don't think you can do this - stuff between machines on the same VLAN won't be routed, thus won't go through your router.

You can put them on different VLANs, which is probably what you should do if you have a business or security reason to restrict traffic between them. Or you could use host-based firewalls, on one or both hosts, but that is a lot more to manage.

share|improve this answer
You can apply port or MAC address based ACL's though, right? – joeqwerty Dec 14 '10 at 23:33
@Joe - If you do that, all you can do it explictly prevent them from communicating at all, right? You can't, say, filter everything except SSH, AFAIK. – mfinni Dec 15 '10 at 2:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.