<div dir="ltr"><div><div><div><div><div><div>Hi everybody!<br><br></div>As a part of a NAC implementation, I've created a new VLAN for the "isolated" devices, from this VLAN, the computers in it, are not able to communicate with nothing, except what I want (via iptables). <br>
So, the thing is that I'm trying to bridge some traffic from one "isolation" VLAN (VLAN 3) to the "production" VLAN (VLAN 800). <br>I'm working on a routed network (Enterasys routing) that take care of routing and VLAN tagging stuff of course...<br>
<br>The point is that I want that the linux box filter the packets between those VLAN's, but I've tried with brctl and ebtables, but at first, the "isolated" computer was not able to reach the servers on the "production" VLAN (I was seeing the ARP requests from the PC, asking for the MAC of its gateway) and after a few tries I managed to put it working, but after a few minutes, the entire network went down... :( So, definately, I'm doing something wrong...<br>
<br></div>Here's an example of the scenario:<br><br></div><div>VLAN 110: <a href="http://172.26.0.0/16">172.26.0.0/16</a> (gw: 172.26.135.136)<br></div><div>VLAN 800: <a href="http://172.20.0.0/16">172.20.0.0/16</a> (gw: 172.20.135.136)<br>
</div><div>VLAN 3: (isolation, no routed by the Enterasys)<br><br></div>___________________<br></div>| PC isolated (VLAN 3)| 172.20.135.136 ____________<br>
</div><div>|IP: 172.26.135.109 | __172.26.135.136_ | |<br></div>|GW: 172.26.135.136 |------->| Cisco 3560 |---(trunk)---->|Enterasys Router|----VLAN3---------|Linux Bridge |<br>
</div>--------------------------------- |--------------------------|-----VLAN800-----| Box |<br><div><div><div><div><div> | |---------------------|<br>
|<br></div><div> VLAN800<br> |<br>
------------ <br></div><div> | Server| <br> ------------ <br>
</div><div> IP:172.20.100.2<br></div><div> GW:172.20.135.136<br>
</div><div><br></div><div>As you can see, the packets from the Router to the bridge box arrive "tagged"... I've tried also configuring the port of "VLAN800" to the Linux Box as an "access port", but the packets never came again to the linux box (I only see the computer ARP requests coming from the VLAN3, passing through the bridge and leaving by the "access" interface...)<br>
</div><div><br></div><div>So, I configured both ports of Enterasys router as "tagged ports" and the linux bridge box as the following:<br><br></div><div></div><div>ifconfig eth0 0.0.0.0<br></div><div>ifconfig eth1 0.0.0.0<br>
</div><div>vconfig add eth0 800<br></div><div>vconfig add eth1 3<br></div><div>brctl addbr br0<br></div><div>brctl addif br0 eth0.800<br></div><div>brctl addif br0 eth1.3<br><br></div><div>With this configuration, the computer can communicate with the servers, but after a while, the entire network goes down! :-/<br>
</div><div><br></div><div>What would be the best way to do this kind of packet forwarding. I know that this work can be done with the Router itself, but it's not able to filter the packets as iptables does (fine grained)... so that's why I'm putting the linux bridge between those VLANs.<br>
<br></div><div>What I'm missing?<br><br></div><div>Thanks in advance!!<br><br></div><div>PS: By the way, STP is disabled in the router and also in the Linux bridge box.<br></div><div><br><br><br><br><br><br><br><br></div>
</div></div></div></div></div>