1

I am configuring a Cisco 881, and am interested in restricting individual ports on the LAN (FastEthernet 0-3). I would like to be able to limit the IP addresses that someone can use based on which port they are connected to.

This way IP ACLs in another location can be used to determine whether the user was physically connected using the correct cable before the TCP connection is established.

700 Software
  • 2,163
  • 9
  • 47
  • 77

1 Answers1

1

If you create one VLAN per physical switch port (the 881 seems to support up to 8 VLANs), you can give each VLAN a separate ip subnet. For example:

f0 has VLAN 100 and subnet 192.168.0.0/24
f1 has VLAN 101 and subnet 192.168.1.0/24
f2 has VLAN 102 and subnet 192.168.2.0/24
f3 has VLAN 103 and subnet 192.168.3.0/24

i.e. if a connection is made from 192.168.2.65 you will know it connected through VLAN 102 and interface f2.

The syntax for assigning VLANs to interfaces is described here and seems to be:

Router(config)# Interface fastethernet2
Router(config-if)# switchport access vlan 102
Router(config-if)# no shutdown
Router(config-if)# end

The syntax for assigning an ip address to a VLAN interface (i.e. the default gateway address for the clients) is seen throughout the configuration guide and seems to be in configured form:

Interface Vlan102
  ip address 192.168.2.254 255.255.255.0

More info on VLANs can be found here and on subnetting here.

Community
  • 1
ErikE
  • 4,676
  • 1
  • 19
  • 25
  • It would seem that I should assign a different subnet to every port, not optimal, but it works. – 700 Software Jan 08 '14 at 15:44
  • The Catalyst switches have something called Port ACL but I don't think the 881 supports them: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vacl.html – ErikE Jan 08 '14 at 17:15
  • I'm not 100% certain of the exact problem you're trying to solve. You could create the subnets such that they may be summed up as one subnet further up stream? You would still have to create and manage them, but they wouldn't become a bother outside of their context. – ErikE Jan 08 '14 at 17:46
  • This answer looks good, just haven't had a chance to test it yet. – 700 Software Jan 09 '14 at 18:01