Connecting an Aruba 2540 Multi-VLAN directly to a modem

[olpo]

Hello,

I'm new to switching and am looking to enable the connectivity of two VLANs configured on an Aruba 2540 Switch to Internet.

Desired Connectivity :
    - VLAN 1 -> VLAN 2: Reject
    - VLAN 2 -> VLAN 1 : Reject
    - VLAN 1 -> internet : Accept
    - VLAN 2 -> internet : Accept

I have the following configuration on my Aruba 2540 Switch:
    - ISP modem connection: 1
    - Trunk :
        - Trk1 : port 1
    - VLAN
        - Vlan 1: 2,Trk1
        - Vlan 2: 3,Trk1

I tried several configurations found on the internet and what seemed to be the closest to the solution was to configure routes after activating "ip route", but when I display them with "show ip route", I never see them in the table and what I try to do don'nt work.

Thanking you in advance for the time you spent on my post and helping me
Oliver

[akg7]

Hello,

It seems you are not looking for communication between VLAN1 & VLAN2 but both should have communication with ISP.

Is this correct?

Can you please share interfaces which you wants to keep it for vlan 1 and vlan 2 and which interfaces towards ISP?

Thanks!

[olpo]

Hello akg7,

Thanks for your reply !

Yes, it is correct. I want to :
- Block communication between VLAN1 & VLAN2
- Allow communication from VLAN1 to ISP router
- Allow communication from VLAN2 to ISP router.

Configuration :
- Trunk :
    - Port 1 connected to ISP router
    - Name Trk1
- VLAN1 : Untagged port 2 & Trk1
- VLAN2 : Untagged port 3 / Tagged Trk1

Desired Connectivity :
    - VLAN 1 -> VLAN 2: Reject
    - VLAN 2 -> VLAN 1 : Reject
    - VLAN 1 -> internet : Accept
    - VLAN 2 -> internet : Accept

Thanks in advance for your help,
Oliver

[akg7]

Hello,

Which ports are under trk1.

Here trk1 is for LACP.

I believe you need to set up ACL as per your requirement.

Thanks!

[parnassus · Accepted solution]

Hi! I'm under the impression you're improperly using the "Port Trunking" on your Aruba 2540 switch: "Port Trunking" means "Links Aggregation". Do you have aggregated physical links? it the answer is "No, I don't" then you should get rid of Trk<id> logical interface you configured and start working only on involved physical interfaces (this just for the VLAN tagging part).

ACL needs to be implemented in VLAN 1 and VLAN 2 to block traffic between them letting traffic to go to any other (non local) network...your Internet behind your Firewall/Router.

[olpo]

Hello,

Thanks for your answers

I was not able to try them today, but I will do it tomorrow and post if I reach my goal.

Have a good evening,
Oliver

[olpo]

Hello,

It works with ACL

Thanks for your help !
Oliver