Could I have a router/firewall device providing WAN connectivity, part of a VLAN on a switch?

For example:

2, L3 Switches. 2 VLANs


Two Internet lines - irrelevant what they are. Both controlled by two Firewalls. I need all VLAN traffic for DefaultVLAN down one WAN, thus one firewall, and the other VLAN100 down the other.


Two ranges, and handing out as the DG, the IP of the switches respectively. In this instance, the range gives out the IP for SW02 as the DG for clients. And the range gives out the IP of SW01 for clients.


SW01, IP's - Default VLAN IP: - VLAN100 IP:
SW02, IP's - Default VLAN IP: - VLAN100 IP:


FW02: ? (Please read on)


SW01, Default Gateway of Switch set to:
SW02, Default Gateway of Switch set to: ?

So now how do I separate it, I want the clients VLAN to have the other FW02 as their default gateway?

  • You don't need two firewalls for starters... but typically you'd create a VLAN interface on your layer 3 for each VLAN; this becomes the default gateway for that VLAN. Create a small /29 network (or /24, but you don't need all those IPs) between the L3 switch and the firewall, add your policy routes (based on source subnet) on your firewall, add both your WAN connections to said firewall... done. EDIT: putting in answer. – gravyface Apr 2 '13 at 23:36

You don't need two firewalls (unless they support failover/high availability) for starters.

Get a decent business class firewall. Cisco ASA 5500 series, Sonicwall TZ 105, pfSense, etc.

Add both WAN connections to the one firewall; I'd probably set them up in at least a failover configuration, but whatever. Your call.

Assuming we're dealing with one L3 switch you've already bought, you can create a VLAN interface for your two VLANs (VLAN 1:, VLAN interface:; VLAN 100: VLAN interface: These become the default gateway for the nodes on each VLAN respectively. Whether that's DHCP or not, out of scope for this question.

Create another VLAN, say VLAN 10. Set the LAN interface of your firewall to an IP on this subnet ( and create a VLAN interface on same subnet ( Assign a port to this VLAN and uplink into your firewall from that port. You should be able to ping the firewall's LAN interface from within the console of the L3 switch.

Update/create the default route on the L3 switch like so gw (pseudo-syntax as obviously it will vary depending on switch make/model, but we want to create a default route to the firewall's LAN interface).

On the firewall, create a route back to your VLAN subnets like so ( gw and then gw

On the firewall, you'll want to look at policy based routing, policy routing, source based routing, etc. (depends on what you get but any half decent router/firewall should support this) but basically you'll want to add a routing rule/policy that looks at the source subnet and assigns a WAN gateway accordingly.

If you don't have a L3 and you're not anticipating a lot of interVLAN routing (i.e. 100s of workstations talking to dozens of servers on different VLANs), don't waste your money on one. Any decent firewall's going to have several physical interfaces (or even one will work with router on a stick, but again, depends on traffic requirements, etc.) and these can take the place of the VLAN interfaces: just carve up a L2 switch into two VLANs like we discussed already, but instead of assigning interfaces (which you likely can't) to the VLAN virtual interfaces, you'll be uplinking into interface LAN1 and LAN2 (or whatever) on the firewall and let it to do the interVLAN routing and/or Internet routing.

Unless you're talking about several switches trunked/tagged together, carrying VLANs from multiple locations, I wouldn't even bother with L2 switches: you could easily accomplish this with just two unmanaged switches, one for each firewall interface. I do prefer L2 switches as there's way more flexibility and management/monitoring options and are reasonably priced typically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.