private network

What is a private network?

Want a secure, private network? Ok, for some reason, you want computers on a network, but you want some computers to have more privacy.  You want a private network?  You want to connect computers to a network.  Then you want this, you want to have some of these things, these computers to be more private than other. Let us give an example.

Example, there is a network and there is a timecard machine connected to this network.  There is also a executive person named “Mr. Lafaso” that has a computer on the network.

Let us review the requirements and goals. Endpoints are anything connected to the network, a computer, LIKE A LAPTOP OR DESKTOP.  It can also be a machine (like a time card machine).  Machines like this are also called

“endpoints” on the network. 

                Goals, requirements:

                a. These two (2) endpoints on the network, the goal is to make them private!!  They can NOT communicate to any other endpoint on the network.

                b. These two (2) endpoints on the network can only connect to part of the INTERNET.

        c. The endpoints, they can only connect to internet IP addresses of 8.8.8.0/24.  Note, the /24, it is the subnet.  This means any ip between 8.8.8.0 and 8.8.8.255

This appears to be a simple requirement, yes?  It is simple yet there are many ways to accomplish the “Private networks” for each computer, or endpoint.

Let us review some procedures to make this goal happen.

1. Lets create two (2) vlans on our network switch (or router).  

Read manuals for your specific devices to create vlans.

What did this accomplish?  We are going to create a vlan and assign it to a port.  This makes a new network, a VIRTUAL LAN (vlan). We assigned the VLAN to a network port on the switch. 

1. Lets create two (2) access lists  on our network switch (or router).

Read your network manuals! Create access lists.

What did this accomplish?  By creating the access lists, we are preventing any communications of the networks to each other.  We also allowed only the network going to out the internet (192.17.200.1) which is the internet gateway IP address.  

 📌 Key takeaway

To keep two VLANs separate on a Cisco switch, you must create the VLANs, assign the switch ports to them, and ensure there is no inter-VLAN routing (or configure Access Control Lists on a router/Layer 3 switch to block traffic between them).

 📌 Final takeaway

To block traffic between VLAN 10 and VLAN 20, you must create an Extended Access Control List (ACL) that explicitly denies traffic from one subnet to the other while permitting all other traffic (like internet access), and then apply it to the corresponding Virtual Interfaces (SVIs) or subinterfaces.

 ⚠️ Watch Out For: Common Pitfalls

Test your configurations! Do not assume your changes were effective!