Yes, the switch can perform VLAN routing, except for the management VLAN, which is VLAN 1 by default. You simply need to ensure the VLANs have an IP address assigned to them and the command # ip routing is included in the config.   Here is a KB article on how to route VLAN 1 on the 6200. [URL]   With the switch performing L3 for the VLANs, the uplink port will need to mimic the gateway configuration. If the gateway is configured as untagged, then the uplink port on the switch will need to be untagged. If the gateway is tagged for VLAN 11, then so will the switch.   The switch will also need a route that directs traffic out of the network. The route will need to be pointed at the gateway. # ip route 0.0.0.0 0.0.0.0 10.10.10.1 (the last IP address is the next hop in the network, the gateway)   Once the switch is routing between all of your VLANs, and forwarding to the gateway, the gateway itself will need to have a route to direct traffic back to the internal network.   If you have no control whatsoever on the gateway, then you may be forced to use a flat network and keep everything in one VLAN. How many VLANs are you working with on your internal network? Do you know what hardware the gateway is?   On to keeping the traffic locked down. With the vlan association command in place: vlan association subnet XXX.230.163.0 255.255.255.248 11 When a client is placed on VLAN 11, the switch should only allow traffic in on VLAN 11 if the traffic is from the above subnet. This will not bind a specific IP to a specific physical port. Example: Client has IP address 192.230.163.2 Client plugs into port 34, which is set to access mode for VLAN 11, the client will be able to communicate on the network. Client plugs into port 35, which is set to access mode for VLAN 11, the client will be able to communicate on the network. Client plugs into port 35, which is set to access mode for VLAN 1, the client will NOT able to communicate on the network.   The most apparent way to ensure that a specific IP Address can only communicate on a specific port, would be to create an IP ACL and apply it to each port.
Hello, I have a PowerConnect 6248 and I want to create a VLAN that only allows specific IPs to run. Port 1 is Uplink to the network configured as general port with VLAN 1 and 11. This is the connection to the network where I get the IPs assigned from I am allowed to use. Devices I connect to the switch right now can generally use all these IPs.  To achieve my goal I created a new VLAN (11) and used the vlan association subnet function to assing IPs to the VLAN which should be allowed. Port 2 is connected with a server which is only allowed to use these IPs I assigned to the VLAN, so I configured Port 2 as general port with VLAN 11 allowed. Though I can still use all IPs. Also VLAN 1 is allowed on that port, otherwise I do not get anything online. When I remove VLAN 11 from Uplink port I also go offline on Port 2. Can you explain me how to achieve what I want? Greetings!
Only allow specific IPs on VLAN