Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

Scenario:

Internet <----> Hardware firewall/router <----> Cisco Catalyst 3560 switch (2 VLANs)

What is the best way to restrict traffic between servers within the same VLAN? Can I create ACL's on our switch for this?

Any advice would be appreciated.

share|improve this question
1  
Use firewalls on both machines. – SpacemanSpiff Dec 14 '10 at 22:12

2 Answers

up vote 3 down vote accepted

With private vlans (pvlans) you can prevent hosts talking to each other even if they're in the same VLAN. There are extensive docs in the Cisco website :-)

share|improve this answer
up vote 0 down vote

I don't think you can do this - stuff between machines on the same VLAN won't be routed, thus won't go through your router.

You can put them on different VLANs, which is probably what you should do if you have a business or security reason to restrict traffic between them. Or you could use host-based firewalls, on one or both hosts, but that is a lot more to manage.

share|improve this answer
You can apply port or MAC address based ACL's though, right? – joeqwerty Dec 14 '10 at 23:33
@Joe - If you do that, all you can do it explictly prevent them from communicating at all, right? You can't, say, filter everything except SSH, AFAIK. – mfinni Dec 15 '10 at 2:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.