Uplink ports & port isolation

[lorn10]

A new little problem has arisen.

I need to isolate my vlan 3 from the other two, vlan 1 and 2. The most simple way to achive this is to use the port isolation command “port-isolate enable”.

Unfortunately this feature is not available for uplink ports (which are the normal Ethernet type at the MSR router models).

I found that uplink port information after intensive research in the H3C MSR Router Series, Comware 5 Layer 2 - LAN Switching, Command Reference guide:

http://download.h3c.com/download.do?id=3684203

My facts are:

192.168.1.x => vlan 1

192.168.2.x => vlan 2

192.168.3.x => vlan 3

In my case it is okay that vlan 1 has a connection to vlan 2. But vlan 3 should be isolated from both of the other two.

So what are my alternatives? Most likely this must be realized over an ACL rule...

Any help is welcome.

[Ivan_B · Accepted solution]

Hello!

This should help:

Create an advanced IPv4 ACL that will deny access to vlan 1 and 2 and allow everything else:

acl number 3333
rule 10 deny ip destination 192.168.1.0 0.0.0.255
rule 20 deny ip destination 192.168.2.0 0.0.0.255
rule 100 permit ip 

then apply this ACL to a Vlan-interface3 in inbound direction:

interface Vlan-interface3
firewall packet-filter 3333 inbound

[lorn10]

Many thanks Ivan_B for your response.

I have applied these changes.

Unfortunately I am still able to login from a laptop with address 192.168.3.50 (running Kubuntu Linux 18.04) over SSH into the MSR 20 router at 192.168.1.1.

Really strange, that ACL rule looks so logical. It could be that there exist some other error in my config. (I have uploaded it in the other “Config migration” thread.)

PS Maybe it's because of my (different) subnet mask, it is at all three networks 255.255.255.0

[Ivan_B]

Subnet mask is /24 (255.255.255.0), but in ACLs we use wildcard masks, so 0.0.0.255 is absolutely perfect match for /24 subnet.

BTW, there is a difference between traffic to the router itself (like in your example with login over SSH from the Ubuntu pc) and pass-through traffic. Could you test if from your Ubuntu pc in Vlan3 you can access some other hosts in Vlan1 except the router itself? BTW, just to be sure we are on the same page - all hosts in all VLANs should have their default gateways pointing to the respective Vlan-interface on the MSR, e.g. we need to be sure inter-VLAN traffic really passes through this router and not through some other device.

[lorn10]

It works now! GREAT!

The rule was absolutely perfect.

The interface was the wrong one. I had to apply the rule at:

interface GigabitEthernet2/0.3

This is the interface which contains the vlan-type dot1q vid 3 and ip address 192.168.3.1 255.255.255.0 information.

Again many thanks, now we have here a nice little Comware “port or VLAN isolation at uplink port” example, - the only one at the web.

[Ivan_B]

I am glad we have clarified it!