[TheBigDog1]

How would in ensure students cannot communicate with users on the management vlan ?

VLAN 2 STUDENT
VLAN 3 LECTURER
VLAN 4 MANAGEMENT

 

[GentleArrow]

tag the management vlan and untag the student vlan

 

[MitchConner]

tag the management vlan and untag the student vlan

Don't do that. Use an acl instead.

 

[GentleArrow]

but that is assuming the equipment in question supports those.

vacl's work at the packet level so I can see that helping in this case.

TheBigDog1 is this Cisco equipment?

 

[MitchConner]

The output is from Cisco packet tracer, the 3560 in the above picture supports acls.

A vlan acl in this instance is about as helpful as your last suggestion of changing the native vlan.

 

[GentleArrow]

wasn't suggesting a vacl, I thought you were.

Here is a discussion on vlan best practices
https://supportforums.cisco.com/discussion/12697771/management-and-native-vlan-best-practices