VLAN routing Procurve 2650

[Dennes Meeusen]

Hi,
I want to create the following setup, but i don't seem to be able to grasp the basics.

1 2650 switch. Ports 1-20 should be in a VLAN for Company A and ports 21-48 in a VLAN for Company B
Both should not be able to route to eachother, but i want to put a DSL router on port 49 for internetaccess from both VLAN's
Suppose CompA has a subnet 192.168.10.0/24
CompB has 192.168.20.0/24 and the router on port 49 has ip: 10.0.0.1/24
Can anybody point me in the right direction on this one?

Thanks!

[Michael_Breuer]

Hello Dennes,

basically you should accomplish this requirement using access-lists (ACL). But I am afraid that your model doesn't support this feature. You would need a fully featured switch like 3500yl series switch.
In your case I would put the ACL on your router. The router would get an IP interface in each VLAN and act as default gw for each VLAN. Then you create an ACL which denies packets from VLAN A to VLAN B and vice versa.

Cheers,

Michael

[Dennes Meeusen]

OK, assuming my router (Cisco ASA 5505) supports multiple VLAN's, this dhould work, right?

To sum it up:
I should create 2 VLAN's with the ports untagged
And for port 49 i should create a tagged port in both VLAN1 and VLAN2, right?
And i should enable routing on the switch?

Am i missing anything here?

[Michael_Breuer · Accepted solution]

Hi Dennes,

an ASA should be fine for this. Terminate both VLANs on the ASA and leave the ProCurve in layer 2 mode. No "ip routing" on it to avoid bypassing the firewall. The connection between switch and ASA can be a tagged connection.

Cheers,

Michael

[Dennes Meeusen]

Thanks