VLAN Communication in same switch (2920)

[Ismael_PD]

Hi everyone,

I'm new on switching i've the basic knowledge on VLAN's. i'm tested my configuration but i think that is wrong because if i do a ping from PC1 to PC2 i've response. I don't want communication between that host

VLAN 1 - IP 192.168.1.1 (port 1-10 untagged)

VLAN 2 - IP 192.168.2.1 (port 11-20 untagged)

PC1 in VLAN 1 - IP 192.168.1.10 gateway 192.168.1.1

PC2 in VLAN 2 - IP 192.168.2.10 gateway 192.168.2.1

The routing is enable and i have a route static for internet 192.168.1.254.

What can i do?

Regards!!

[Apachez-]

Any L3-switch who has "ip routing" enabled will automatically route between vlans for which it has an ip address configured for (aka SVI).

So in your case, remove the ip for one (or both) of your vlans and your L3-switch wont route between the vlans (even if you have ip routing enabled).

Also note that you shouldnt use vlan 1 for anything.

[Vince-Whirlwind]

So there are a number of ways to have your two subnets but not route between them:

1/ With the config you have right now, add in an access list on at least one of the VLAN interfaces which denies traffic from one subnet to the other.

HOWEVER, this will break your second subnet's access to the internet, because you've put the internet on VLAN1.

2/ Keep the existing config, configure the access list(s), but change the internet router address to be in a 3rd entirely separate subnet.

3/ Remove both IP addresses from the switch. Create a new subinterface on the router and put 192.168.2.1 on it. Configure at least one access list separating the two subnets.