- Community Home
- >
- Networking
- >
- Switching and Routing
- >
- Comware Based
- >
- Re: Can we restrict routing between VLANs in A5120...
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-22-2011 11:43 PM
11-22-2011 11:43 PM
We have VLAN 10 and several other VLANs in an A5120 EI switch, and we want routing only from each of the other VLANs to VLAN 10 only, and no routing among the other VLANs. Can this be done using ACL?
Example:
VLAN 3 can route to VLAN 10
VLAN 4 can route to VLAN 10
VLAN 5 can route to VLAN 10
VLAN 3 should not be able to connect to VLAN 4 nor 5.
VLAN 4 should not be able to connect to VLAN 3 nor 5
VLAN 5 should not be able to connect to VLAN 3 nor 4.
Thanks in advance.
Van
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-24-2011 03:18 PM
11-24-2011 03:18 PM
SolutionHello,
It's not a possible like Cisco. on 3Com/H3C switch you can"t implement ACL to filter intervlan traffic.
One way is to implment port based ACL
regards
HP AIS Network Infrastructure
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-25-2011 03:08 AM
11-25-2011 03:08 AM
Re: Can we restrict routing between VLANs in A5120 using ACL?
Hi,
I have one question: is your A5120 switch also a router for your network or do you have some other box to do that (routing)? If the second one than you should disable (filter) routing between vlan's on your router.
Regards,
V
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-26-2011 12:20 AM
11-26-2011 12:20 AM
Re: Can we restrict routing between VLANs in A5120 using ACL?
Hi,
The box is supposed to do the routing. There is no other router.
As Sinibade put it, ACL cannot be used to restrict intervlan traffic.
So we are left with doing port-based ACL.
Thanks for your help.
Van
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-27-2011 04:54 AM
12-27-2011 04:54 AM
Re: Can we restrict routing between VLANs in A5120 using ACL?
Can u give example for port based cus i also have same issue need to deny traffic from vlan 3 to 4 but need to permit traffic from 4 to 3 when we try to acheve this the packet reach to vlan 3 but return packet getting faild
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-27-2011 05:50 PM
12-27-2011 05:50 PM
Re: Can we restrict routing between VLANs in A5120 using ACL?
Hi TJtheone:
In my case, we wanted traffic to route from vlan 3 to vlan 2, vlan 4 to vlan 2, but not between vlan 3 and vlan 4.
Your case is different in that you want routing in one direction only in the same pair of vlan.
Sorry I do not know how this can be achieved.
Maybe someone in the community can help on this.
Thanks,
Van
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-29-2011 01:41 AM
12-29-2011 01:41 AM
Re: Can we restrict routing between VLANs in A5120 using ACL?
who said you cannot apply ACL to interVLAN routing ??
check if the below command is available on the CLI please:
[device] packet-filter vlan ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-29-2011 09:52 AM
12-29-2011 09:52 AM
Re: Can we restrict routing between VLANs in A5120 using ACL?
Yes but it wan't affect when i try but i didn't try this on 5120 but 3com 5500ei
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-31-2011 06:33 AM
12-31-2011 06:33 AM
Re: Can we restrict routing between VLANs in A5120 using ACL?
It depends on how and where did you apply it (which direction), I know about the directions in the old ProCurve switches (E Series), In means the traffic coming IN to the VLAN from the client in that VLAN, out means traffic coming from OUTSIDE (from other vlans) into the vlan
think about the VLAN as normal interface, where in is coming from the client connected to the interface and out is going out to the client (from the switch out to that interface).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-29-2013 05:26 PM
12-29-2013 05:26 PM
Re: Can we restrict routing between VLANs in A5120 using ACL?
You actually can Implement an ACL to filter Intervlan Traffic.
You can only implement it towards the inbound direction of the vlan interface.
-by default when you create the vlans and add IP's to the vlan interfaces the hp switch 5120 will add default routes to every vlan that has an IP. So by default all vlan's will be able to comunicate with each other.
Lets say you have 3 vlans and you want vlan 11 and 13 to not comunicate with each other and vlan 12 to comunicate with all of them.
Vlan11 - 10.0.11.0/24
vlan 12 - 10.0.12.0/24
vlan 13 - 10.0.13.0/24
On the a5120 CLI
First create the vlan and assign ip address to the vlan interface.
system-view
vlan 11
quit
int vlan 11
ip add 10.0.11.1 255.255.255.0
quit
and so on for the other vlans - These ip addresses are going to be the default gateways of the vlans, so your clients will point to them as the default gateway.
now lets say I want to restrict traffic from users on vlan 11 (10.0.11/0/24) to get to vlan 13 (10.0.13.0/24) and vice versa.
First lets create an advanced acl to deny vlan 11 to vlan 13
acl number 3011
description Inbound vlan 11 traffic
rule deny ip source 10.0.11.0 255.255.255.0 destination 10.0.13.0 255.255.255.0
rule permit ip source any
quit
now go into vlan interface 11 and apply the acl
int vlan 11
packet-filter 3011 inbound
quit
- this will prevent vlan 11 from accesing vlan 13
-this needs to be applied to the inbound interface of vlan 11 since all of vlan 11's traffic is being sent to 10.0.11.1 (which is the vlan's interface) as its gateway.
now to prevent vlan 13 traffic to vlan 11
acl number 3013
description Inbound Vlan 13 traffic
rule deny ip source 10.0.13.0 255.255.255.0 destination 10.0.11.0 255.255.255.0
rule permit ip source any
quit
int vlan 13
packet-filter 3013 inbound
quit
now vlan 11 and 13 can no longer ping or comunicate with each other.
Also advanced ACL's start in the 3000 range so I just add the vlan to the end of it. Ex. vlan 11 - 3011
hope this helps
Jason Keubke
CCNA
HP AIS Network Infrastructure