We have a somewhat exotic setup. Some devices connected to a cisco switch must be administered by a third party and we don't want to give this third party full access to our network. There devices do not have a routed subnet of it's own, they are part of the subnet the switch is in. This cannot be changed unfortunately.
We've come up with the following solution (which doesn't work):
- We've put the ports these devices are on on a separate vlan.
- We've connected a routerboard appliance with two interfaces to the switch, one interface is connected to the main vlan, the other one is connected to the new vlan for the devices.
- We try to setup a bridge (combined with a firewall so only incoming connactions are possible) on the routerboard, so the devices are accesable.
We cannot get this solution to work, the routerboard relays packets from one interface to the other, where the ceisco rejects it because of the wrong vlantag.
We tried setting up vlantagging on the routerboard (using this as reference: http://blog.butchevans.com/2010/02/to-tag-or-not-to-tag-that-is-the-question/) but no traffic seems to hit the routerboard.
Can we change the cisco settings to accept or ignore the wrong vlan tags, or how should we configure the routerboard?
Thanks in Advance!