topic Separating VLANS on Procurve 4208 in Switches, Hubs, and Modems

Separating VLANS on Procurve 4208

James M. Dougherty — Wed, 09 Sep 2009 00:00:26 GMT

I am unable to prevent Vlan 4 from seeing Vlan 3.
Vlan 4 is the wireless vlan that I want to prevent from seeing the office network vlan 3

Vlan 3 and Vlan 4 both use the same port to the router, A1.
I have even gone so far as to tell all the ports on vlan 3 to drop anything from ports E19 and E20 which are part of vlan 4 via:

filter source-port A2 drop E19-E20

I have done this for every single port on the switch, except port A1 which connects to the router. I have done the reverse for ports E19-E20 on Vlan 4 to prevent them from communicating with anything but each other and port A1, the trunk port.

yet I can still very easily get to the DB server by it's first name with out any trouble.
so if I go "run -> //mystorage"
It comes up with the login screen to access the server with no hitch. I do not want this to happen at all. I have tried everything, including using "forbid" on each Vlan interface.
Any help would be greatly appreciated. It's seems that everything that the manual say's to do does absolutely nothing to prevent the wireless vlan from being able to access the office vlan.

Thank you in advance.

Re: Separating VLANS on Procurve 4208

Patrick Terlisten — Wed, 09 Sep 2009 05:15:10 GMT

Hello James,

please post a "show running-config" from you switch.

Best regards,
Patrick

Re: Separating VLANS on Procurve 4208

James M. Dougherty — Wed, 09 Sep 2009 05:35:59 GMT

I'll get that on here in the am, seems that the config I emailed myself to my home account has gone missing. Tomorrow can only be a better day.

Re: Separating VLANS on Procurve 4208

James M. Dougherty — Wed, 09 Sep 2009 15:37:59 GMT

Finally had time to get the switch config to you.
Here it is.
Thank you again for any help.

Re: Separating VLANS on Procurve 4208

Pieter 't Hart — Thu, 10 Sep 2009 07:12:20 GMT

I think your vlan4 connects to vlan3 via the router on A1.

So all filter rules will have no effect as the ports do not communicate to E19/E20 directly (only through A1).

Look into this router config, maybe you can creat an ACL there.

regards,
Pieter