Switch XMG1915 isolate port
All Replies
-
Yes the router needs to do VLAN and then it need to not route to other LANs
The only other way is if the switch did ACL by a Ethernet Type IP and Destination IP Address/Prefix 192.168.0.0/16 then policy rule to Discard the packet so that the device can't get to any other device and allowed to internet keep in mind if your router does DNS you need to Weight that rule high and allow it or have the device use like 8.8.8.8
The switch does port isolation but its use is if you set it for ports 3 and 4 with port 2 not set for isolation then device on port 3 can't get to device on port 4 or the other way round but can go out port 2 as the uplink to the router
0 -
Is there a switch that supports ACLs with comparable port speeds?
I attempted to untag port 2, but the device can still access the LAN.
0 -
Is there a switch that supports ACLs with comparable port speeds?
XS1930-10
Unless you can get you router to do tags and isolation
1 -
Hi @switcher ,
Based on the screenshot you provided, we confirm that the XMG1915's port configuration with VLAN51 is correct. If devices connected to XMG1915's port 3 can still access devices on other ports (other VLAN), please contact the router vendor's support team to check the routing configuration.
Don't miss this great chance to upgrade your Nebula org. for free!https://bit.ly/4g2pS9L
1 -
So the switch ACL is ingress blocking I recommend you use go to Security > classifier > classifier global set match order to manual also note Zyxel ACL system is allow unless you block.
So here your device you want to block on port 1 connecting to another device by it MAC is how the a classifier would look
Then you need to add a Policy rule for this classifier to Discard the packet note you can hold down Control key to add many classifiers.
The order of the Policy rule does not matter its the Weight set by the classifier the higher the Weight the higher the priority.
If your goal is to block this device from accessing 192.168.0.0/16 you make a classifier with port 1 Ethernet type IP and destination IP address 192.168.0.0/16 with Weight 32760 to Discard the packet then you need a classifier for DNS to your router like 192.168.0.1 so port 1 Ethernet type IP and destination IP address 192.168.0.1/32 destination port 53 with Weight 32767 and make a Policy rule with no change so the order will allow device on port 1 to 192.168.0.1 and block every IP going to 192.168.0.0/16
Or another way you can allow device MAC to gateway MAC only which is a bit more to setup as you need to allow FF:FF:FF:FF:FF:FF for DHCP and ARP destination MAC
0
Categories
- All Categories
- 414 Beta Program
- 2.3K Nebula
- 132 Nebula Ideas
- 92 Nebula Status and Incidents
- 5.4K Security
- 183 USG FLEX H Series
- 258 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 37 Wireless Ideas
- 6.2K Consumer Product
- 237 Service & License
- 374 News and Release
- 79 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight