Recommended ACL configuration on Omada Switch for common scenarios
TL-SG2008P , TL-SG3452X , SG3452XMPP , TL-SG2218P , TL-SG3452XP , TL-SG2016P , SG2210XMP-M2 , SG3428XPP-M2 , SG3428XMPP , ER7406 , TL-SG2210P , SG2210MP , TL-SX3008F , ER7206 , ER8411 , TL-SL2428P , TL-SX3016F , SG2218 , SG3428 , TL-SG3452P , TL-SG3428X , ER605 , SG3218XP-M2 , SL2428P , TL-SG3428X-M2 , SG3210X-M2 , TL-SG3428XF , ER707-M2 , ER7412-M2 , TL-SG2210MP , SG3428X-M2 , SG3210 , SG3452 , TL-SG3428XPP-M2 , SX3032F , SG3452X , SG3210XHP-M2 , TL-SG3210XHP-M2 , SG2008 , TL-SG2428P , ER7212PC , SG3428XF , TL-SG2452 , SG2005P-PD , SG2428LP , SX3008F , SG3428MP , SG3428X , SG3452P , SX3016F , TL-SG3428X-UPS , SG2218P , SG2428P , SG2008P , SG3452XP , SG2452LP , TL-SG3428 , TL-SG2218 , SG2210P , SG2016P , TL-ER7206 , TL-SG3428MP , TL-SG2008 , ER706W-4G , TL-SG3210 , TL-SG3452 , ER605W , TL-SX3206HPP , SG3428XMP , TL-SG3428XMP , SX3206HPP , ER706W
Recent updates may have expanded access to feature(s) discussed in this FAQ. Visit your product's support page, select the correct hardware version for your device and check either the Datasheet or the firmware section for the latest improvements added to your product.
Contents
Allow the access to specific resources only
Allow the access to the internal network only
Allow the access to the internet only
This article introduces how to manage the network by configuring ACL in controller mode.
- Omada Hardware/Software/Cloud-Based Controller V5.0 or above
VLAN (Virtual Local Area Network) technology divides a physical LAN into multiple logical LANs, i.e. the VLANs. Hosts in the same VLAN can communicate directly with each other, while those in different VLANs cannot, thereby enhancing the security of the LAN. When a LAN is divided into multiple VLANs, broadcast messages will be limited within the same VLAN, that is, each VLAN forms a broadcast domain, which effectively limits the scope of the broadcast domain. By using VLANs, different hosts can be assigned to different workgroups, and hosts in the same workgroup can be located in different physical locations, making network construction and maintenance more convenient and flexible.
Topology example: Host A&B belong to Network A (VLAN 10), Host D and the Server belong to Network B (VLAN 20). In this scenario, corresponding VLAN interfaces and address pools are typically created, so that clients connected to different networks can obtain IP addresses from different subnets. Let's assume the Server's IP address is 192.168.20.10.
The interface/port configurations in the example are as follows:
Switch |
Switch A |
Switch B |
Switch C |
||||
Port |
1 |
2 |
3 |
1 |
Others |
1 |
Others |
Egress Rule |
Tagged |
Tagged |
Tagged |
Tagged |
Untagged |
Tagged |
Untagged |
Native Network |
1 |
1 |
1 |
1 |
10 |
1 |
20 |
VLAN |
1,10,20 |
1,10 |
1,20 |
1,10 |
10 |
1,20 |
20 |
Allow the access to specific resources only
Network A and Network B are not allowed to communicate with each other, but Network A is allowed to access specific servers in Network B.
Step 1. Configure network ports and interfaces.
Go to Settings > Site Setting > Wired Networks > LAN and click Create New LAN to start creating the interfaces of VLAN 10 and VLAN 20.
Step 2. Create both interfaces by specifying their relevant parameters. After entering the subnet IP, click Update IP Range to update the IP address pool range of this subnet. Leave the other options as default, and click Apply to complete.
Step 3. Create a port profile for each switch and bind it to the corresponding port.
On the LAN configuration page in the previous step, click Profile > Create New Port Profile to create a port profile. When creating a VLAN interface, the controller will automatically create a profile for the corresponding network (Network A, Network B). You can then directly apply it to the access port of the corresponding switch.
Create a profile for the uplink port of Switch B/C with the following parameters:
Switch B:
Switch C:
Then bind each profile to the corresponding port: click Devices in the navigation bar, and then go to Switch A > Ports > ACTION to edit the ports profile of Switch A. Bind Port1 to the profile "All", and bind Port2 (connected to Switch B) and Port3 (connected to Switch C) to the uplink profiles of Switch B and C respectively.
Perform the same operation to bind the profiles of Switch B and C to their uplink port and access ports.
Switch B:
Switch C:
Step 4. Create an ACL to deny the mutual access between Network A and Network B.
Go to Site Settings > Network Security > ACL > Switch ACL and click Create New Rule.
The parameters of the Rule are as follows. Enable Bi-Directional in Advanced Settings to apply this ACL to all ports on Switch B and Switch C.
Step 5. Create an ACL to allow Network A to access a specific server in Network B.
Go to Site Settings > Profile > Groups > Create New Group, select IP Group for Type, and enter the server address for IP Subnet. To add multiple IPs to the Group, click Add Subnet.
Step 6. Create an ACL to allow VLAN 10 to access the Server IP Group, and apply this ACL to all ports of Switch B and C.
Note: When finished, all ACL entries are as follows. Because the ACLs take effect based on a top-down priority, we need to put the two A_to_B_Server_permit ACLs at the top of the list.
Before:
After:
Allow the access to the internal network only
You can restrict a specific VLAN (network)’s access to the internet, and only allow it to access the internal network.
After completing the network configuration based on the previous topology, assume that such a requirement should be met: devices connected to Network A cannot access the internet but can access other internal networks. Due to the default blacklist mechanism of TP-Link switch's ACL, it is necessary to create a Permit ACL from Network A to all other subnets, and then create an ACL that denies any access to Network A.
Step 1. Go to Site Settings > Network Security > ACL > Switch ACL > Create New Rule, and configure the parameters as follows to allow Network A to access all subnets:
Step 2. Apply this ACL to all ports on Switch B.
Create an ACL that denies all access to Network A, which can be realized through IPGroup_Any. Apply this ACL to all ports on Switch B too.
When complete, all ACL entries are as follows:
Allow the access to the internet only
You can allow a specific VLAN to access the internet, and restrict its access to the internal network (guest network requirement).
Complete the interface and port configurations based on the previous topology.
Step 1. Create an ACL to deny Network A's access to all other subnets. Refer to Scenario 2 and apply this ACL to all ports of Switch B.
Step 2. Create an ACL to allow access to Network A, which can also be realized through IPGroup_Any, and apply it to all ports of Switch B.
Follow the instructions above to perform the ACL configuration for common scenarios.
Get to know more details of each function and configuration please go to Download Center to download the manual of your product.
Related FAQs
Is this faq useful?
Your feedback helps improve this site.
What’s your concern with this article?
- Dissatisfied with product
- Too Complicated
- Confusing Title
- Does not apply to me
- Too Vague
- Other
We'd love to get your feedback, please let us know how we can improve this content.
Thank you
We appreciate your feedback.
Click here to contact TP-Link technical support.
Deze website gebruikt cookies om de gebruikservaring te verbeteren, onlineactiviteiten te analyseren en om gebruikers de best mogelijke ervaring te bieden op onze website. U heeft de mogelijkheid op ieder moment de cookies te weigeren. Bekijk onze privacyverklaring voor meer informatie.
Deze website gebruikt cookies om de gebruikservaring te verbeteren, onlineactiviteiten te analyseren en om gebruikers de best mogelijke ervaring te bieden op onze website. U heeft de mogelijkheid op ieder moment de cookies te weigeren. Bekijk onze privacyverklaring voor meer informatie.
Standaard Cookies
Deze cookies zijn noodzakelijk voor de werking van de website en kunnen niet worden uitgeschakeld.
TP-Link
SESSION, JSESSIONID, accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Zendesk
OptanonConsent, __cf_bm, __cfruid, _cfuvid, _help_center_session, _pendo___sg__.<container-id>, _pendo_meta.<container-id>, _pendo_visitorId.<container-id>, _zendesk_authenticated, _zendesk_cookie, _zendesk_session, _zendesk_shared_session, ajs_anonymous_id, cf_clearance
Analyse en Marketing Cookies
Cookies voor analyse geven ons de mogelijkheid uw activiteiten op onze website te volgen en zo de functionaliteit van de website aan te passen en te verbeteren.
Marketing cookies kunnen op onze website worden geplaatst door externe adverteerders waar wij mee samenwerken om een profiel te creëren met uw interesses en u zo van relevante advertenties te kunnen voorzien op andere websites.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads & DoubleClick
test_cookie, _gcl_au