I am looking for some expert networking advice on what would be "best practice" if I wanted to achieve the goal below based on the available equipment we have.
- SonicWALL TZ 105
- HP V1910-48G
- 2x external subnet VLANs that can provide service to internet through DNAT from SonicWALL i.e. 192.168.1.0/24 & 192.168.10.0/24.
- Hosts in these two external subnets can reach the internet.
- Hosts in these two external subnets can route / communicate to each other.
- There will be other "private" subnet VLANS (storage, backup, management, etc.) but these of course do not need to be externally route-able or reachable.
I have read two trains of thought on how to set this up so far.
The first is to "hairpin" route through the SonicWALL by creating sub-interfaces (VLAN-aware) ports on the SonicWALL and trunk to the switch. I believe this is called Router-on-a-stick?
The second is to create a separate "routing" domain (subnet) between the switch and firewall so there would effectively be three subnet VLANS: 192.168.0.0/24 between firewall and switch and the aforementioned two inter-VLAN subnets 192.168.1.0/24 and 192.168.10.0/24.
I probably clobbered those examples and got some terminology wrong but basically, what would best practice be to ensure security, scalability, etc.? Also, I would not mind knowing the expedient set up just in case I cannot get it set up "proper".
P.S. So far I have tried the former set up but have only been successful on getting one of the external subnet VLANS to be able to reach the internet.