Need VLAN isolation help

[abyssling]

I am looking for info on isolating VLAN traffic so that it only goes to the gateway/fw, or to a specified application server, but isolates the traffic from the rest of the network.

I want to deploy a solution for internet access for kiosk pc's and in conference rooms for visiting presenters/educators where they will need internet access but will be denied access to the rest of the network.

Can any Cisco gurus give me a hand on how I could accomplish this on a 2950G?

Also in a separate scenario I would like to create another VLAN only giving access to a specified application server, the domain controller for authentication and the internet but denying all other traffic. This is on a Baystack 450. These machines will be using static IP's so DHCP is not an issue.

Do I just create a VLAN and only grant access to those IP's in the ACL? is it that simple? Reason for my conundrum is I was always told that the 2950 is not capable of an isolation VLAN, or is this not the technical definition of an isolation VLAN? Can anyone give me a hand?

 

[Fint]

I made a VLAN on one of my 6509's and ACL'ed the crap out of to accomplish a similar thing. They can talk to our DHCP server (via the helper-address) so their IPs are assigned automagically, but they can't even ping their gateway IP This is likely not the best/easiest way to do this, but it works for me.

interface Vlan69
description ***guest vlan with dhcp***
ip address 10.11.69.1 255.255.255.0
ip access-group guest-lock-down-in in
ip access-group guest-lock-down out
ip helper-address 10.5.1.24
no ip redirects

!

ip access-list extended guest-lock-down
deny ip 10.5.1.0 0.0.0.255 any
deny ip 10.0.0.0 0.255.255.255 any
deny ip 192.168.1.0 0.0.0.255 any
deny ip 172.16.0.0 0.0.255.255 any
permit ip any any
ip access-list extended guest-lock-down-in
deny ip any 10.0.0.0 0.255.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 172.16.0.0 0.0.255.255
permit ip any any