New to ACLs and need advice (HP Procurve)

[bmittleider]

I am looking for a little guidance on setting up some ACL rules on my HP Procurve 5412zl. Our district recently upgraded our infrastructure and I am trying to get the final touches completed by creating a few ACLs to help secure our network. Below I have included our current VLAN structure as well as the subnet for the VLAN. I have already configured the 5412 to handle routing and added the appropriate ip helper-addresses to the VLANs.

 

VLAN 1: Default (10.10.10.0/24)

VLAN 5: Servers (10.5.1.0/24)

VLAN 10: High School (10.10.0.0/23)

VLAN 20: Middle School (10.20.1.0/24)

VLAN 30: Primary School (10.30.1.0/24)

VLAN 40: Intermediate School (10.40.1.0/24)

VLAN 50: Administration Offices (10.50.1.0/24)

VLAN 60: IT Management (10.60.1.0/24)

VLAN 100: Internet (WAN) (192.168.100.0/24)

VLAN 200: Security (172.16.200.0/24)

VLAN 250: Guest (192.168.250.0/24)

 

VLAN 250 is our guest network that I am trying to isolate on the network. On this VLAN I have a pfSense box and 20 small access points distributed throughout our four buildings. Since this VLAN is to be isolated I don’t want to use the primary DHCP/DNS server that our other VLANs will be using so I have configured pfSense to handle DHCP for this network. I have configured switch to use the ip helper-address of the ip to the pfSense box. The pfSense box has dual network cards which are configured for VLAN 250 and VLAN 100. This box acts as the gateway to the Internet and does not rely on any internal servers.

 

What I need is for VLAN 250 is to keep all traffic in VLAN 250 and not have the ability to access any other VLAN.

 

VLAN 250 Static IPs

- Switch 192.168.250.1

- pfSense Server 192.168.250.5

- Access Points 192.168.250.10-30

 

Thanks in advance.

[PiqueABoo]

What I need is for VLAN 250 is to keep all traffic in VLAN 250 and not have the ability to access any other VLAN

 

Not an expert, especially on that model, but the usual trick for HP is NOT to set an IP address for that VLAN on the switch e.g. if you've given it say 192.168.250.1, then get rid of it.

[DMcCoy]

Just don't give it an IP address for the VLAN. Everything will have to go through the pfsense server then as there is no routing.