Prevent network discovery between members of same VLAN

Latest reply: Aug 24, 2015 21:06:45 1425 1 0 0

At our ISP's we use Huawei s5300 switches, and we want to upgrade our setup to accomplish the following:

  1. Place a number of different customers/users under same VLAN.
  2. Assign one static-public IP address per client/customer and prevent them use another IP address from the same subnet.
  3. Isolate each client/interface in the same VLAN, effectively having them as if they are part of different VLAN. The goal is to prevent broadcast-based network auto-discovery protocols that can locate all hosts under the same broadcast domain.


The idea is to: a) save on IP addresses since if we put each client in a separate VLAN we "lose" at least 3 IPs, and b) avoid using MUX VLAN (Private VLAN in Cisco terms) due to configuration complexity.

We are stuck at point 3. If customers terminate the public IP on a server, then for instance Customer A can see the server of Customer B,C,D in Windows network folder. Here is a sample configuration for clients connected to interface 0/0/3 and 0/0/4. As we learned from the net the command "port-isolate enable group 1" may do the trick but for us it had no effect.


interface Vlanif2 (The subnet is based on public IP addresses)
   ip address X.X.X.X 255.255.255.0
..
user-bind static ip-address X.X.X.19 interface GigabitEthernet0/0/3
user-bind static ip-address X.X.X.20 interface GigabitEthernet0/0/4
..
interface GigabitEthernet0/0/3
   port link-type access
   port default vlan 2
   port-isolate enable group 1
   arp anti-attack check user-bind enable
interface GigabitEthernet0/0/4
   port link-type access
   port default vlan 2
   port-isolate enable group 1
   arp anti-attack check user-bind enable


Thanks in advance.

  • x
  • convention:

petre.bozikov
Created Aug 24, 2015 21:06:45 Helpful(0) Helpful(0)

[EDIT] Clarification, we need port-isolation to work across multiple switches. Here is a better sample:

[Huawei Router]   
interface Vlanif2 (The subnet is based on public IP addresses)
ip address X.X.X.X 255.255.255.0
..
[Huawei Switch 1]
user-bind static ip-address X.X.X.19 interface GigabitEthernet0/0/3
interface GigabitEthernet0/0/3
  port link-type access
  port default vlan 2
  port-isolate enable group 1
  arp anti-attack check user-bind enable
[Huawei Switch 2]
user-bind static ip-address X.X.X.20 interface GigabitEthernet0/0/4
interface GigabitEthernet0/0/4
  port link-type access
  port default vlan 2
  port-isolate enable group 1
  arp anti-attack check user-bind enable

  • x
  • convention:

Reply

Reply
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login