03-28-2012 04:13 AM
I have set up a new interface 10.77.0.1/18 and have "block intra-subnet traffic" set.
I have also created a custom zone and have "block intra-zone traffic" set.
I have created 3 different policies for 3 different groups:
I want them to be unable to reach each other and thought with that blocking set up that would be the case, but if I use subnet /18 on the hosts they can ping each other.
The hosts are connect to the juniper interface via a 3500 catalyst switch.
Are they able to reach other via the switch even though block intra-subnet traffic and block intra-zone traffic is set up on the ssg.
If I am unable to hide them from each other this way how can I do this, via vlan's and subinterfaces?
03-28-2012 05:31 AM
03-28-2012 11:06 AM
I tried with vlan's and subinterfaces for a couple of hours this afternoon but seemed to be unable to get anywhere, could not even ping the ip of the subinterfaces let alone get out to the internet and this was even being connected straight to the interface with a client.
I believe using secondary ip's on the interface should be able to get me to hide the different networks from each other, but would still like to have a go at vlan's and subinterfaces if anyone can give step by step at all that would be most helpful.
Thanks in advance
03-30-2012 12:23 AM
It is an SSG-320 and a Cisco Catalyst 3550 I was using. I had created 3 subinterfaces on the firewall with 3 vlan tags 100, 200 and 300. Did I need to create these same vlan's with identical tags on the switch as well, was that were I was going wrong?
03-30-2012 05:21 AM
04-12-2012 07:43 AM
Great thank you Nikolay I followed your instructions for setting up the switch and that worked fine.
Thanks again for your help.