1

I'm working on a project regarding Network Security and I've come to the topic regarding VLANs.

I was wondering if it is possible to set up multiple VLANs (VLAN0, 10, 20, 30) in a way that all VLANs can communicate with VLAN0 but not with eachother?

1 Answer 1

4

By definition, each VLAN is its own broadcast domain, and traffic from one VLAN stays on that VLAN.

However, you can do what you're proposing with routing. You'll have to create routes from each VLAN to the default VLAN (and firewall rules, if necessary) and vice versa.

Without a router or a Layer 3 switch, the VLANs will be isolated from each other.

4
  • So it is possible to route all the VLANs to only be able to communicate to VLAN0? May 10, 2013 at 14:32
  • Yes, it is possible to only route traffic for VLAN 2 to 300 to VLAN0 only but not VLAN2 to communicate with VLAN300.
    – Travis
    May 10, 2013 at 14:40
  • The basic idea is that in one VLAN you have the DHCP Server, AD, Shares, etc... I want the other VLANs to be able to communicate with the servers there. However, each VLAN must not be allowed to communicate (view) computers in other VLANs other than the VLAN that has the DHCP, AD, Shares, etc.. May 10, 2013 at 14:43
  • You'd accomplish it with ACLs on the routing device. If the number of disparate networks is small, you might be better served by using a firewall with security levels.
    – LilCodger
    May 10, 2013 at 21:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .