Restrict traffic of a VLAN to only the ports in the VLAN

[ChrisPixley]

I have a VLAN (230) that is configured on several downstream switches from my Layer 3 switch. I need to restrict the traffic on this VLAN to only talk to this VLAN (VLAN 230 only talks to VLAN 230).

[Mloraditch]

You can use switch ACLs for this: https://documentation.meraki.com/MS/Layer_3_Switching/Configuring_ACLs

You could also rehome the vlans to your firewall and configure the restrictions there. If its an MX that would be via group policies.

[ChrisPixley]

Can I place the ACL only on the ports where this VLAN is used?

[ChrisPixley]

I would assume that rehome VLAN to MX is as simple as adding the VLAN to the MX.

[Mloraditch]

Switch ACLs are shared globally so no.

As to rehoming it, providing your MX is already trunked to your switches and the VLAN is allowed, yes you would just delete off your Layer 3 switch and add to your MX. Being careful to record any relevant settings, especially DHCP reservations and such.

[ChrisPixley]

Sounds like rehoming the MX is not the right direction for us. 

My concern in setting up a ACL is its' impact on my other VLAN's.   I have VLAN 10 & 224-231 in this network.  I need to isolate VLAN 230 without impact the other VLANS.  If I create an allow rule for 230 and then follow it up with all deny rule, would It impact my other VLANS negatively?  

[Mloraditch · Accepted solution]

This may help explain how that will work:  https://documentation.meraki.com/MS/Other_Topics/Switch_ACL_Operation

In my mind there are two possible solutions :
A) If you don't care about internet
An allow rule saying source/destination with VLAN 230 subnet in both fields is allowed.
Followed by denies with each being a source of any and  destination VLAN 230 and one the opposite.
B)If you care about internet
An allow rule saying source/destination with VLAN 230 subnet is allowed.
Followed by a series of explicit pairings of each subnet you want to deny access to vlan 230, two rules for each subnet with one being where that subnet is the source and vlan 230 is the destination and then a second with the opposite.

Switch ACLs don't support subnet lists, but if there is a relevant supernet you could use that to consolidate the denies.

[ChrisPixley]

Thank you.  Off course the 230 is in the middle of the supernet /21 

[PhilipDAth]

>You could also rehome the vlans to your firewall

When the data flows are not high - this is my preferred approach.  I like to do all my firewalling and access restrictions in one place.

Switch ACLs can also be applied per-vlan - so you could consider moving these devices into their own VLAN.  You can also simply specify the devices address in the source and destination field.

If you have an MS Advanced licence, and a suitable switch, you could also consider using Adaptive Policy.  You can apply a policy to a specify port this way, using an Adaptive Policy "tag".

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy_Overv...