0

Can the switch HP 2910al, restrict traffic coming to it based on it's IP/subnet settings without using the routing functionality? Or is it possible to configure something like HP 2530 (layer 2) to bridge traffic?

(I know in theory not, but the settings seem too complicated feel like there are always caveats.. hence the question)


We have the switch currently configured to 2 VLANs (VLAN1, VLAN10). The only reason for the VLANs is to limit network traffic going to one VLAN (say VLAN10) to maintain high throughout in that network. It is trunked with another switch that connects to a larger network (say VLAN10, VLAN1 and VLAN20).

Is there a way to limit VLAN20 traffic going into VLAN10 and VLAN1 (as currently configured) purely based on IP if I were to remove the VLAN settings on that switch?

The switch the traffic is coming from is HP 2530, which I has less functionality anyway. But is there a way to configure that to bridge traffic?

(Switching the two switches would work, but physically not feasible :/)

0

The 2910al switches support ACLs, so you can filter any L3 traffic based on source/destination IPs, protocols, protocol ports. Whether this traffic is routed on the 2910, on an external router or only switched doesn't matter.

You could prevent any communication between e.g. 10.0.10.0/24 (VLAN 10) and 10.0.20.0/24 (VLAN 20) by configuring

ip access-list extended "deny1020"
10 deny ip 10.0.10.0/24 10.0.20.0/24
20 deny ip 10.0.20.0/24 10.0.10.0/24
9999 permit ip any any

and apply this ACL to the ingress (trunk) ports. ACLs on the 2910al work only on ports, not on VLANs. ACLs have an implicit last entry deny ip any any, so line 9999 takes care of allowing all other traffic.

The 2530 switches support ACLs also on the VLAN level, so they might be easier to apply there. Generally, you'll want to filter unwanted traffic as soon as possible.

2
  • Using two allow rules (and the default deny) might be better here as well. Can the ACL Filter on the VLAN ID as well? – eckes May 27 '18 at 16:27
  • Only allowing traffic within each VLAN 10 and VLAN 20 isn't the same, the difference being the traffic to/from other subnets. The answer's ACL only denies traffic in between. ACLs on the 2910 filter on IP addresses, IP protocols, and transport layer ports only. – Zac67 May 27 '18 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.