Restricting Layer 2 Forwarding Among Clients - D-Link DWS-1008 - AirPremier MobileLAN Switch Product Manual

To clear port 4, which uses tag value 11, from VLAN marigold, type the following command:
DWS-1008# clear vlan marigold port 4 tag 11
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y
success: change accepted.
To completely remove VLAN ecru, type the following command:
DWS-1008# clear vlan ecru
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y
success: change accepted.
Note: You cannot remove the default VLAN (VLAN 1). However, you can add and remove ports. You can
also rename the default VLAN, but D-Link recommends against it.

Restricting Layer 2 Forwarding Among Clients

By default, clients within a VLAN are able to communicate with one another directly at Layer 2. You can
enhance network security by restricting Layer 2 forwarding among clients in the same VLAN. When you
restrict Layer 2 forwarding in a VLAN, MSS allows Layer 2 forwarding only between a client and a set
of MAC addresses, generally the VLAN's default routers. Clients within the VLAN are not permitted to
communicate among themselves directly. To communicate with another client, the client must use one
of the specified default routers.
Note: For networks with IP-only clients, you can restrict client-to-client forwarding using ACLs.
To restrict Layer 2 forwarding in a VLAN, use the following command:
set security l2-restrict vlan vlan-id
[mode {enable | disable}] [permit-mac mac-addr [mac-addr]]
You can specify multiple addresses by listing them on the same command line or by entering multiple
commands. Restriction of client traffic does not begin until you enable the permitted MAC list. Use the
mode enable option with this command.
To change a MAC address, use the clear security l2-restrict command to remove it, then use the set
security l2-restrict command to add the correct address.
clear security l2-restrict vlan vlan-id [permit-mac mac-addr [mac-addr] | all]
Note: There can be a slight delay before functions such as pinging between clients become available
again after Layer 2 restrictions are lifted. Even though packets are passed immediately once Layer 2
restrictions are gone, it can take 10 seconds or more for upper-layer protocols to update their ARP
caches and regain their functionality.
D-Link DWS-1008 User Manual