Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create a VLAN in which my PS3 can access a remote PC that feeds it video. I want my PS3 not to be able to communicate to the internet, and be able to move that remote PC into the same VLAN as the PS3 and not be able to get online. I have a Cisco Catalyst 3550.

What would be the best way to configure this PS3 and remote PC? Vlans to allow separate connections.

OR Should I configure an access control list so that the playstation 3 does not go online?

Which is easier and which is faster?

share|improve this question

closed as off topic by ewwhite, Shane Madden, Jenny D, EEAA, Dave M Apr 28 '13 at 13:02

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

A VLAN is a separate logical layer 2 network without physically separate infrastructure.

Understanding this and your requirements, it is obviously faster and simpler to use an ACL.

Despite this, if for some reason you wanted to create a VLAN anyway, bearing in mind that each VLAN represents a separate broadcast domain and separate logical layer 2 network, you could simply not route the subnet the non-Internet-connected VLAN is on to the Internet. You must route between your VLANs, however, if you want the devices on one VLAN to communicate with those on another (the typical way to do this is the router-on-a-stick configuration). This means that all your devices would use the inter-VLAN router as their default gateway, which would in turn be responsible for sending Internet traffic toward the Internet (or not, as the rule may dictate), and doing NAT if required. Depending on topology, your inter-VLAN router may or may not also be a border gateway.

You can freely switch access ports from one VLAN to another. Ensure you are serving DHCP to each VLAN, and that you either request a new IP (reboot the device or release and renew the lease as applicable) when the VLAN is switched (shutting down the port and stating it again will usually effect this, from the infrastructure side).

share|improve this answer
thank you very much for your time. – Bain Apr 28 '13 at 12:22
No problem at all. – Falcon Momot Apr 29 '13 at 7:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.