1

Updated Network Diagram

The Question: What is the proper configuration for the L3 switch to be allowed to assign public IPs for the firewalls?

I guess All I need is that the switch L3 act as a layer 2 switch...Right?

Update 1- The Same ISP provides two public subnets /29 ( wan 1 and wan 2) 2- SFP connectors are connected to Cisco 3650 3- The Firewalls are Fortigate and they are working as Routers (NAT Mode).

I just need to know:

  1. what is the ports configuration on the layer 3 switch that will be connected to the ISP?

  2. what is the ports configuration on the layer 3 switch that will be connected to the Firewalls? Or any device will be connected directly to the L3 switch to have a public IP?

Improve this question
9
  • 1
    That depends on several factors. You need to give us more information. We don't even know what the switch model is, so there is no way to give you a configuration, but we also need to know a lot more about the ISP connection. Is it a single connection to one ISP, multiple connections to one ISP, or single connections to two ISPs? Can the firewalls be configured as transparent firewalls? You need to include all the relevant information.
    – Ron Maupin ♦
    Commented Jul 17, 2017 at 22:49
  • Sorry for my bad descriptions. I updated my question. Thank you for your response.
    – Basem Abdulrahem
    Commented Jul 18, 2017 at 14:17
  • I'm not convinced that your network design is really correct. If you are going to introduce a SPoF (Single Point of Failure) by using the single switch, then why not just use a single firewall for both ISP connections? Then, you could eliminate the (unprotected) switch. Also, if the firewalls are doing the routing, why do you need routers inside the firewalls? Also, you don't normally connect the hosts directly to the routers. Could it be that those are switches? I believe you may be overthinking this. I would probably go with a single firewall and layer-3 switches inside for the routing.
    – Ron Maupin ♦
    Commented Jul 18, 2017 at 14:50
  • What is your reason for using a switch here? Media converter? Do you need to run BGP with your ISP?
    – Ron Trunk
    Commented Jul 18, 2017 at 15:06
  • 1
    Well if you don't know the credentials of the switches, you cannot configure them. You probably want a VLAN for each ISP network (assuming the two connections are separate networks), or one VLAN if the two connections use the same network. You will need to be able to log into the switches to create the VLAN(s).
    – Ron Maupin ♦
    Commented Jul 18, 2017 at 17:44

3 Answers 3

Reset to default
2

Generally, you'd want to avoid plugging a switch directly into the ISP (even a layer 3) but if your Fortigate is acting as a router, you can use the switch by doing the following:

Assign it one of the IP's from your ISP. Switch your links to trunk link connecting to the router, and access links to the end users. Set your default gateway (including your gateway of last resort back to the ISP) and you should have a bare bones network.

You can spread out and run VLANs, but I would start with it as easy as possible, make sure it works, then add customization one piece at a time.

Improve this answer
0

Both 3650 layer3 switch acts as layer2 devices . Natting should done on fortigate firewall . A default route should Configured in firewall pointing towards gateways of ISP .

So nat translation happen in firewall . Frame outbound security policy for internet access .

Souce as :LAN subnet

Destination as : ANY

Action : allow

Services : Https (or others)

Frame inbound policy in fortigate firewall for incoming traffic to access internal hosted server resources from internet.

Improve this answer
-1

First step is to understand the topology of your network ,that we can use for example i used ring topology for our company...... ring topology is used for inconvience network,if one side is blocked ,we can connect with another side.... then we can configure the switch ,set the name for switch and we can use the interface either trunk or access port.... then we will pass the Vlan for security process.... port security is used for connect a single system with that mac address.... then we want to create SNMP for network link down issues..... vlan can be tagges or un tagged

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.