How to separate CPEs ?

[cmarmonier]

Hello

My network :

network.png

There are 2 groups of CPEs : the group VLAN 100,200 and the group VLAN 1001,2001
I want all CPEs can communicate with the ISP
I want CPE of the group VLAN 1000,2000 can't communicate with others CPE of the same group
I want CPE of the group VLAN 1001,2001 can communicate with others CPE of the same group

How can I do it (How can I isolate CPE of the group VLAN 1000,2000 with them ?) ?
=> I want a solution that can work for a network of 10000 CPEs
=> I can isolate CPEs connected to a switch with user/network port but it doesn't operate if CPEs aren't connected to the same switch
=> I don't want use static route with MAC address : it is too restrictive to implement

[silvio]

Hi,
look in guide for feature port-mapping. I think this will help you.
regards
Silvio

[cmarmonier]

Hi,

=> I can isolate CPEs connected to a switch with user/network port but it doesn't operate if CPEs aren't connected to the same switch

port mapping is user/network port : the problem is when a CPE is in another OS6860, the next OS6860 can't know if packet come form an user or network port.

[cmarmonier]

There is a solution but I don't know if it is possible to implemente
=> I want to use VLAN translation to identify packets which come from CPEs and forbid them to egress on an another CPE port

network.png

For OS6860s connected to CPE with VLAN 1000/2000 :
- ports connected to CPE : VLAN translation 1000 -> 1003 and 2000 -> 2003 (only for uptsream)
- ports connected to CPE and VLAN 1000/2000 : mode user port
- the others ports : mode network port
- VLAN 1003 and 2003 portmap : all ports which aren't connected to a CPE

For the OS6860 connected to ISP :
- VLAN translation 1003 -> 1000 and 2003 -> 2000 (only for uptsream)

Is it possible to implemente ?

[cmarmonier]

... It can't operate because MAC Table will be wrong (traffic will be flood on all ports), ins't it ?