Shared Server/Shared Internet Access Application Shared Servers (Mail Server, data server, Internet Access servers) can be access by all user groups, but the access between groups are not allowed (for the performance or security consideration) L2 solution: Asymmetric VLAN or Traffic Segmentation L3 solution: L3 switch + ACL to limit the access between group. Servers V2V3V4

V x Gw V x Gw V1, Servers x V1, Internet Gateway ISP V1: port 1-8 Shared Server(s) or Internet Gateway V2: port 9-16 VLAN2 users (PC or hub/switch) V3: port VLAN3 users (PC or hub/switch) Requirement: 1.V2 and V3 can access V1 for shared Server (with IPX, same network IP, AppleTalk, NetBEUI etc) 2.V2 and V3 can access Internet Gateway for Internet Access using same network IP. 3.No access between V2 and V3. Traffic Segmentation Standalone configuration Config traffic_segmentation 1-24 forwarding_list 1-24 Config traffic_segmentation 9-16 forwarding_list 1-16 Config traffic_segmentation forwarding_list 1-8,17-24

Net x/24 Gw Net1 ( x) can be accessed by Net2, Net3, Net4. Net2, Net3, Net4 cannot access each other Des-3326S Net x/24 Gw Servers Net x/24 Gw Net x/24 Gw L3 Switch Shared Server application Scenario: Only shared IP network can be accessed

# create access_profile rule # permit only x to be accessed by other subnet create access_profile ip destination_ip_mask permit profile_id 10 config access_profile profile_id 10 add access_id 11 ip destination_ip create access_profile ip source_ip_mask permit profile_id 20 config access_profile profile_id 20 add access_id 21 ip source_ip # permit x and x can access themselves. create access_profile ip source_ip_mask destination_ip_mask permit profile_id 30 config access_profile profile_id 30 add access_id 31 ip source_ip destination_ip config access_profile profile_id 30 add access_id 32 ip source_ip destination_ip config access_profile profile_id 30 add access_id 33 ip source_ip destination_ip #### other nets added here # deny others. create access_profile ip source_ip_mask deny profile_id 40 config access_profile profile_id 40 add access_id 41 ip source_ip Rules: 1.If Dest. IP= x, permit 2.If Src. IP= x, permit 3.If DestIP= x and destIP= x, permit 4.If DestIP= x and SrcIP= x, permit 5.If DestIP= x and SrcIP= x, permit 6.Deny Others Test: 1.Net2 ( x), Net3, Net4 PCs can Ping Net1 PC ( x). 2.Net2, Net3, Net4 PCs cannot ping each other. L3 Switch Shared Server application