Restricting traffic between Vlans.

Question

We have an F5 servicing our DMZ. It hosts the external IPs and acts a router for the DMZ servers.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; +--- [ VLAN_2110 ][ Internet ] ---- [ F/W ] ---- [ F5 ] --+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; +--- [ VLAN_2310 ]Recently a new requirement has emerged to keep one group of Vlans from talking to another group. A for instance would be that VLAN_2110 and VLAN_2310 in the above sketch would not be allowed to talk to each other.Can the F5 do this?

dario_garrido · Answer

Hello scarville,
From my perspective, the easiest way to achieve this is to configure two reject VS to deny the traffic between those vlans.
1. Configure one reject VS listening on VLAN_2110 and use the IP range of VLAN_2310 as destination.
2.&nbsp;Configure one reject VS listening on VLAN_2310 and use the IP range of VLAN_2110 as destination.
&nbsp;

ca_valli · Answer

F5 is a default deny deivce, so inter-VLAN routing is denied out-of-the-box unless you explicitly allow it (using something like an IP forwarding Virtual Server).

To prevent clients in a VLAN from accessing Virtual Servers on the "Internet" side potentially leading to servers in the other VLAN, you can configure the VS to listen only on Internet VLAN. This is usually common practice.

If the requirement is to have completely dedicated VRF's as well, you might want to take a look at F5 Routing domain feature https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-routing-administration-11-6-0/8.html

psilva · Answer

here's Route Domains:&nbsp;https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-tmos-routing-administration-14-1-0/route-domains.html

Forum Discussion

Restricting traffic between Vlans.

3 Replies

Recent Discussions

About shun list for L7 DDoS?

CONNECTION IS LOST DUE TO SELF IP IS DELIVERED

ASM instance creation

Can iRule mask the payload content on event logs of security

Disacard SSL::cert mode to ignore when default SSLClient profile is set to request or require

Related Content

Office 365 Tenant Restrictions

SSL Orchestrator Advanced Use Cases: Enabling GCloud Organization Restrictions

fellow traffic

Restricting Access to Virtual from client IP address in X-Forwarder-For HTTP header

Block traffic