VLAN issues in planning a network

I'm currently planning a network with a few VLANS. Unfortunatly, I've forgot how to solve this! This is what I got:

I need, as stated by the pic, for every VLAN (exept vlan 200, that is for guests) to have accessability to the servers, but not each other. So, what VLAN should I place it in? Shall I just put up some access lists to deny the VLANS to reach each other but allow them to reach the servers, or is there another (perheps better) solution?

Morty

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

Morty3

I guess this is the way to go, lol. I dont want to sent tags over to the Server-access switch, is that possible?

Morty3

Actually I want to sent the dot1Q tag aswell. No more issue, it seems like ;P

dynamik

Why don't you just put them in their own VLAN and do the routing with that L3 switch? You need to have some L3 interaction in there somewhere.

Morty3

How would you do it, dynamik? Server VLAN 150 and not allowing vlan 200? Please expand!

rwwest7

Morty3 wrote: »

How would you do it, dynamik? Server VLAN 150 and not allowing vlan 200? Please expand!

VLAN Pruning?

ColbyG

You could keep everything in a single VLAN if you were using Private VLANs. Or you could use the L3 switch as the gateway for all VLANs and configure ACLs allowing traffic to the servers only, not between clients. There are a lot of ways to accomplish what you want.

Morty3

Now we are doing it as planned, with segmented LANs using a l3 switch. About the DHCP though, I was thinking about using the IP Helper Address *dhcp-server add* command on the l3-switch. Am I thinking right? Will it work? Never done this before and I dont want to catch myself failing...

Also, where should I place that command? The l3-interface or the SVI?

APA

On the SVI as it is acting as the gateway.... but you'll only need ip helper-address if the DHCP server is in a different broadcast domain from the SVI that you configure it on....

helper-address turns certain broadcast specific traffic (i.e DHCP initial request etc) into unicast requests....

Morty3

Yeah and it is. The DHCP server is the firewall on the picture (It is an ISA) and every vlan will get a corresponding 192.168 network, ie the vlan 100 will get 192.168.100.0 and the vlan 20 will get 192.168.20.0.