VLAN separation, how to organize?

Question

Mikrotik

Good afternoon, I'm putting the network in order and decided to break the networks into VLANs. And there was a question on the "correct" organization. There is a core based on Mikrotik RB1100AHx2, followed by an HP 1920 switch, to which servers and a trunk line (optics) are connected, and after the optics, another switch to which the rest are connected. I created several VLANs on the core, configured hybrid (as far as I understood with HP hybrid = trunk) ports on the switch, everything is fine in the tests. It was decided to separate part of the company into a separate VLAN, to which no one will have access. Tell me, how will it be correct to separate the VLAN on the "main" switch or on the core?

Answer 1

If you need to "cut off and forget" - then you can on the switch. If, nevertheless, it is supposed to then provide access to this separate VLAN somehow (well, or FROM it) - then on the core. Routing that on a kernel? HP, wangyu, not L3?