Hi, all. I have a hEX PoE and I’m trying to configure two separate networks, both with access to the WAN/Internet but not to each other. One of the networks is solely on Ether2. There is a bridge that contains ports Ether3, 4, and 5. VLAN1 uses that bridge as its interface and VLAN2 uses Ether2 as its interface.
I have a computer connected directly to Ether2 and it is able to ping both out to the Internet and a printer on VLAN1. Can anyone offer advice as to why objects in these VLANs are able to talk to each other, and how to stop it while leaving WAN communication working?
My apologies for the delayed response. I never saw a notification that someone had replied and got tied up with other tasks. Here is the configuration:
I think you should relook at your planning and network structure.
There is no need for vlans if you only have two subnets.
There is no need for two bridges in you only have two subnets.
In fact there is no need for a bridge at all.
You have mixed them up in such a way that the config is prone to errors.
Suggest instead you articulate your requirements/
a. what users/devices or groups of user/devices do you have.
b. what traffic flows do you want them to have and not to have.
Then a network diagram showing the infrastructure in place will complete the picture and
a design/config will naturally fall out.
How many ports do you need? Are there are devices involved (switches, access points etc).
On most low-end switch chips hardware offloading of VLANs means that traffic within same VLAN but spanning multiple physical ports will be handled by switch chips. Inter-VLAN traffic, however, is routed and only high-end switch chips (e.g. in CRS3xx and some other devices) support HW offloaded routing.
None of switch chips support firewalling in hardware, ROS can only offload traffic which could be fast-tracked.