Private VLAN or dot1q and Router on a Stick ???

[netadmin65]

Here's the scenario:

I wish to separate traffic between departments (users on
their own specific VLAN), then restrict where each VLAN
can go (Finance can access their own VLAN, plus the
Domain Controller and e-mail servers, and the finance
server, BUT NOT, lets say, the RESEARCH server located on
another VLAN).

How would I go about setting this up?

Router on a stick and dot1q tagging? or private VLANs
on the switch? Also, would I need an ACL to restrict
VLAN traffic? I'm quite adept at learning something
once given initial direction as to how to proceed, but
I'm unsure what to do in this case.

Router is a 2621XM, switch is a 4506 with sup2.

Any help would be appreciated. Thanks...

 

[netadmin65]

Oh, forgot to mention, 4506 with sup2 is CatOS...
If everything was IOS and layer 3 switching, I
would not have needed to ask this question.

 

[wybnormal]

In it's simpliest form, the router on a stick works pretty well. You have two VLANs on the switch created by port ports into two groups. From each group comes a cable to a etherport on a router like a 2514. The router controls the traffic. Now, this is not exactly on a stick.. more more like a vlans on a 2legged chair. It not used much because the router is used only for the vlans and routers tended to be expensive in the past. But, now a 2514 can be had for a hundred bucks.

The stick design will use something like a 2620 with a fastether port that can be configured to use trunking. On the switch make the two vlans AND a trunked port that has both VLANS. send the trunk to the router using fastethernet and 802.1q (or ISL depending on the switch) A one legged router or router on a stick.

Config examples:

http://www.cisco.com/en/US/tech/tk389/tk390/tech_configuration_examples_list.html

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu

 

[baddos]

You can easily use your 2621 as a router on a stick. Configure your router's fastethernet port as an ISL trunk and the port on the switch as an ISL. Make sure to configure the appropriate IP address configure on the sub interfaces on your router, and your off to the races.

 

[davemiller]

If your going to trunk, use 802.1q.
Both router(sub-int) and switch will support it.
Newer Cisco switch IOS has dropped ISL.