Unsolved
This post is more than 5 years old
42 Posts
0
2884
Vlans
I have set up three dell powerconnect switches 6224 in a stack. i have configured three Vlans.
1.management
2.Vmtraffic
3.iSCSI
i have configured the IP addresses for all three Vlans. I have enabled routing just to see if i am able to ping machines in the Vlans and this is working fine from Hyperterminal. My problem is how do i now separate iSCSI so that the general population does not access it? How do i set the ports on the switch so that i am able to manage the Vlans and how to i connect the general population on the LAN.
DELL-Willy M
802 Posts
0
May 2nd, 2012 12:00
You can use ACLs to isolate traffic on your switch. Once you have the different VLANs talking to each other freely throughout your network you would a write and apply the ACL to block certain traffic.
ACL Overview
Access Control Lists (ACL) filter network traffic by controlling whether packets are forwarded or blocked at the switch's interfaces. The switch examines each packet to determine whether to forward or drop the packet, based on the criteria specified by the Access Control Entries (ACE). ACEs are the statements which define what the switch will do with a packet if it meets one of the filters. Multiple ACEs make up an ACL.
You can create both MAC-based and IP-based ACLs on PowerConnect switches. Regardless of which one you create, there are three main steps to creating and implementing ACLs as shown below:
Step 1 - Create IP / MAC ACL
Step 2 - Create ACE statements
Step 3 - Define the ACL on an interface
Sample config:
console# config
console(config)#access-list ip-acl deny ip 172.16.101.10 0.0.0.0 172.16.101.70 0.0.0.0 eq 23
console(config)#access-list ip-acl deny ip 172.16.101.10 0.0.0.0 172.16.101.70 0.0.0.0 eq 80
console(config)#access-list ip-acl permit every
console(config)# interface ethernet 1/g1 (62xx or pre-4.x firmware)
console(config)# interface gi1/0/1 (70xx or 4.x firmware)
console(config-if-1/g1)#ip access-group ip-acl in
console(config-if-1/g1)# end
console#
Hope this helps,
Please keep us updated.
Dev Mgr
9.3K Posts
0
May 2nd, 2012 13:00
Another option; if you don't plan on doing replication between your iSCSI SAN and another iSCSI SAN, just remove the IP from that VLAN and remove any routes and there's no way in (or out), which is best for iSCSI (unless you are doing replication).