1

Could I have a router/firewall device providing WAN connectivity, part of a VLAN on a switch?

For example:

2, L3 Switches. 2 VLANs

DefaultVLAN  10.1.1.0/24
VLAN100      192.168.1.0/24

Two Internet lines - irrelevant what they are. Both controlled by two Firewalls. I need all VLAN traffic for DefaultVLAN down one WAN, thus one firewall, and the other VLAN100 down the other.

DHCP:

Two ranges, 10.1.1.0/24 and 192.168.1.0/24 handing out as the DG, the IP of the switches respectively. In this instance, the 10.1.1.0 range gives out the IP for SW02 as the DG for clients. And the 192.168.1.0/24 range gives out the IP of SW01 for clients.

Switches:

SW01, IP's - Default VLAN IP: 10.1.1.10 - VLAN100 IP: 192.168.1.10
SW02, IP's - Default VLAN IP: 10.1.1.11 - VLAN100 IP: 192.168.1.11

Firewalls:

FW01: 192.168.1.1
FW02: ? (Please read on)

Switches:

SW01, Default Gateway of Switch set to: 192.168.1.1
SW02, Default Gateway of Switch set to: ?

So now how do I separate it, I want the 10.1.1.0/24 clients VLAN to have the other FW02 as their default gateway?

1
  • You don't need two firewalls for starters... but typically you'd create a VLAN interface on your layer 3 for each VLAN; this becomes the default gateway for that VLAN. Create a small /29 network (or /24, but you don't need all those IPs) between the L3 switch and the firewall, add your policy routes (based on source subnet) on your firewall, add both your WAN connections to said firewall... done. EDIT: putting in answer.
    – gravyface
    Apr 2, 2013 at 23:36

1 Answer 1

4

You don't need two firewalls (unless they support failover/high availability) for starters.

Get a decent business class firewall. Cisco ASA 5500 series, Sonicwall TZ 105, pfSense, etc.

Add both WAN connections to the one firewall; I'd probably set them up in at least a failover configuration, but whatever. Your call.

Assuming we're dealing with one L3 switch you've already bought, you can create a VLAN interface for your two VLANs (VLAN 1: 192.168.1.0/24, VLAN interface: 192.168.1.1; VLAN 100: 10.1.1.0/24 VLAN interface: 10.1.1.1). These become the default gateway for the nodes on each VLAN respectively. Whether that's DHCP or not, out of scope for this question.

Create another VLAN, say VLAN 10. 172.16.0.0/29. Set the LAN interface of your firewall to an IP on this subnet (172.16.0.1/29) and create a VLAN interface on same subnet (172.16.0.2/29). Assign a port to this VLAN and uplink into your firewall from that port. You should be able to ping the firewall's LAN interface from within the console of the L3 switch.

Update/create the default route on the L3 switch like so 0.0.0.0 0.0.0.0 gw 172.16.0.1 (pseudo-syntax as obviously it will vary depending on switch make/model, but we want to create a default route to the firewall's LAN interface).

On the firewall, create a route back to your VLAN subnets like so (192.168.1.0 255.255.255.0 gw 172.16.0.2 and then 10.1.1.0 255.255.255.0 gw 172.16.0.2).

On the firewall, you'll want to look at policy based routing, policy routing, source based routing, etc. (depends on what you get but any half decent router/firewall should support this) but basically you'll want to add a routing rule/policy that looks at the source subnet and assigns a WAN gateway accordingly.

If you don't have a L3 and you're not anticipating a lot of interVLAN routing (i.e. 100s of workstations talking to dozens of servers on different VLANs), don't waste your money on one. Any decent firewall's going to have several physical interfaces (or even one will work with router on a stick, but again, depends on traffic requirements, etc.) and these can take the place of the VLAN interfaces: just carve up a L2 switch into two VLANs like we discussed already, but instead of assigning interfaces (which you likely can't) to the VLAN virtual interfaces, you'll be uplinking into interface LAN1 and LAN2 (or whatever) on the firewall and let it to do the interVLAN routing and/or Internet routing.

Unless you're talking about several switches trunked/tagged together, carrying VLANs from multiple locations, I wouldn't even bother with L2 switches: you could easily accomplish this with just two unmanaged switches, one for each firewall interface. I do prefer L2 switches as there's way more flexibility and management/monitoring options and are reasonably priced typically.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .