vlan condivision? security?

[Diego Castelli]

Hi all, i'm configuring a 2650 (j4899c) and i'm asking if it's possible to configure every port of a single vlan to not communicate between others less than one specific.

the mean is to provide a set of ports with the same IP class that can communicate only with the port of the router.

speaking with someone in HP He tells me that this would be possible issuing the command "vlan-condiv" or "vlan-sec" and setting the ports singularly tagged with the router port...

I was VERY CONFUSED...
I thought that it is possible to tag ports only on vlans...

Anyway I can't find the command, neither googling '"vlan-sec" site:hp.com' or '"vlan condivision" site:hp.com'

Is there anyone that can tell me what to do and what to trust?

Thanks

[Daniel Friedhoff]

I'm not sure of the syntax, but could you create an access rule that would drop all traffic except that destined for the internet gateway?

[Diego Castelli]

Ok, thanks. I'll wait for someone that can tell me the syntax or finding access rule commands in the CLI

[Art Wiens]

If you don't mind doing some reading yourself, there seem to be a whole host of manuals for the 2600 series here:

http://h40060.www4.hp.com/procurve/includes/manuals/index.php?cc=il&lc=he&content=2650_6108

Cheers,
Art

[Matt Hobbs · Accepted solution]

You need to use the source port filter feature. It'll do exactly what you're after.

[Diego Castelli]

Matt is right.

After playing up with commands and manuals i found the command and i was able to write a batch to generate commands to paste on the CLI of the SWITCH...

i copy here to help someone in the future:

@ECHO OFF
Ogni porta deve droppare da 2 a se stesso meno uno e da se stesso più uno a 50
for /L %%i IN (2,1,50) DO (
set /a prima = %%i-1
set /a dopo = %%i+1
echo filter source-port %%i 2-!prima!,!dopo!-50
)


The batch SHOULD be executed in a Shell with /V:ON option. 4 ex:

CMD /V:ON
.bat

bye