Updated 04/11/22 - updated x.1 with x.0 for Networks: There was a time where .0 is not accepted, but now it is fixed.

Hello All.

I have created a new version of the previous design I shared I shared. In this version, a new VLAN has been added (Isolated).

Use Case:

This Isolated VLAN is to complement the limitation of the "Guest" feature for Wireless, specifically, the end-device isolation (i.e. all wireless clients connected to Guest WiFi can't see each other). The Guest feature only works for Wireless Clients only so this Isolated VLAN do a similar thing: prevent other Wired Clients in the same VLAN to see each other (and also not see other Clients in other VLANs). The Isolated VLAN end devices must still be able to access the Internet.

I have listed all the ACLs needed below, along with the layout. If you want to see the ACL in Action, I have a video uploaded and you'll find the testing and demo at Part 4 of the video.

VLAN Info:

• VLAN 1-Admin (192.168.1.x)- this is the Native/Default VLAN 1. Access to all VLAN, can get granular Access to IoT VLAN with VNC and SSH
• VLAN 10-Home (192.168.10.x) - Access to all except Admin VLAN, granular access to IoT VLAN with VNC and SSH
• VLAN 20-Guest (192.168.20.x)- Access to Internet only, no access to same-VLAN devices. Wireless ONLY
• VLAN 30-Cameras (192.168.30.x)- Access to same-VLAN devices only, no Internet
• VLAN 40-Isolated (192.168.40.x)- Access to Internet only, no access to same-VLAN devices. Wired ONLY
• VLAN 90-IoT (192.168.90.x)- Access to same-VLAN devices with Internet, granular access to Home VLAN with DNS

Device List:

• ER-7206 v1 / v1.2.3

• OC-300 v5.7.6 / v1.14.7

• SG-2210MP v1 / v1.0.7

• EAP-235 v1 / v3.1.0

Note: DNS Server @ Home VLAN: 192.168.10.75

ACLs:

For Guests, make sure the Guest Network check box for Wifi is checked 

Gateway ACLs:

1. Deny Home to Admin
   Direction: LAN > LAN
   Policy: Deny
   Protocols: All
   Source > Network > Home
   Destination > Network > Admin
    
2. Deny Camera to Internet
   Direction: LAN > WAN
   Policy: Deny
   Protocols: All
   Source > Network > Camera
   Destination > IP Group > IPGroup_Any
    
3. Deny Camera to All
   Direction: LAN > LAN
   Policy: Deny
   Protocols: All
   Source > Network > Camera
   Destination > Network > Admin
   Destination > Network > Home
   Destination > Network > Guest
   Destination > Network > IoT
   Destination > Network > Isolated

Switch ACLs:

1. Permit VNC to IoT
   Policy: Permit
   Protocols: All
   Source > IP Port Group > (Subnet 192.168.90.0/24, Ports: 5800, 5900)
   Destination > Network > Home
    
2. Permit SSH to IoT
   Policy: Permit
   Protocols: All
   Source > IP Port Group > (Subnet 192.168.90.0/24, Port: 22)
   Destination > Network > Home
    
3. Permit DNS Port to Home
   Policy: Permit
   Protocols: All
   Source > Network > IoT
   Destination > IP Port Group > (Subnet 192.168.10.75/32, Port: 53)
    
4. Deny IoT to All
   Policy: Deny
   Protocols: All
   Source > Network > IoT
   Destination > Network > Admin
   Destination > Network > Home
   Destination > Network > Guest
   Destination > Network > Camera
   Destination > Network > Isolated
    
5. Permit Isolated To Net
   Policy: Permit
   Protocols: All
   Source > Network > Isolated
   Destination > IP Group > (Subnet 192.168.40.1/32)
    
6. Permit Isolated To Net Reverse
   Policy: Permit
   Protocols: All
   Source > IP Group > (Subnet 192.168.40.1/32)
   Destination > Network > Isolated
    
7. Deny Isolated To All and Itself
   Policy: Deny
   Protocols: All
   Source > Network > Isolated
   Destination > Network > Admin
   Destination > Network > Home
   Destination > Network > Guest
   Destination > Network > Camera
   Destination > Network > Isolated