Restricting VLAN Traffic

[TJ Williams]

Device = HP 2626 J4900C Switch

2 VLANS - VLAN A (wired) / VLAN B (wireless)

some users have been asking for the ability to print when using their laptops/wireless connection in VLAN B. The printers are located in VLAN A. Some wired devices in VLAN A also access the printer.

I've enabled IP routing, and configured an access point in VLAN B with the switch VLAN IP as the gateway. I've configured the printer in VLAN A with the switch VLAN IP as the gateway. Users in VLAN B can now send print requests to VLAN A.

My question is, is there any way to limit access from VLAN B to ONLY the printer in VLAN A? I understand that ACLs are not an available function on the 2626, and IP lockdown does not work when IP Routing is enabled on a 2626. Is there any available alternative using this switch?

The only idea I can come up with is putting the printer itself, and the other wired devices that use it, in VLAN B. That will make my job a bit harder, since those machines will be unable to hit the servers in VLAN A for AV updates / policies / etc.

[groque]

Hey TJ

First of all you need a switch which can assign an Access Control List (ACL) to a specific VLAN. Unfortunatley I don't think an HP2626 would work the 3500yls work no problem.

If you have a Layer 3 device which your layer 2 switches connect to configure an ACL which states something like this

permit source (VLAN B) destination (Printer (on VLAN a) permit any and assign that on the interface. If you had a VLAN ACL capable switch you would assign the ACL to the VLAN.

I hope that makes sense.

[TJ Williams]

Thanks for replying.

Yeah, the 3500 would be great. It is however way out of my company's IT budget.

I was trying to find a work-around with my existing equipment.

I suppose this is simply out of the scope of my current equipment's capabilities.