I'm having difficulty wrapping my head around how to set this up and the MPLS vendor is being no help so I figured I would ask here.

I have a 2 node MPLS each site having internet access on the same circuit the MPLS rides in on. These circuits replace dedicated internet access at each site with an IPSEC tunnel between the sites. We want to leave our existing firewalls in place as they provide content filtering and VPN services. I am trying to configure a layer 3 switch (a cisco SG300-10P) at each site to set up this scenario.

The relevant info (ip addresses changed to protect my idiocy)

Site A

  1. Local Lan:
  2. Existing Firewall (internal):
  3. MPLS Gateway to Site B:
  4. Internet IP Range
  5. Carrier Gateway to internet

Items 3 and 5 are on a single peice of copper coming from an adtran netvana (Carrier equip I have no access)

Site B

  1. Local Lan:
  2. Existing Firewall (internal):
  3. MPLS Gateway to Site A:
  4. Internet IP Range
  5. Carrier Gateway to internet

Items 3 and 5 are on a single peice of copper coming from an adtran 908e (Carrier equip I have no access)

So given the above what I want to do at each site is set up these cisco switches so that:

Port 1 = Carrier Connection Port 2 = Interal Lan Port 3 = Firewall

Where the local lan is not exposed to the Internet IP range (ie if some yahoo sets their machine up on a provided internet ip with the carriers gateway it doesn't work) Or put differently from port 1 all traffic in the internet subnet can only exit on port 3 and from port 1 all traffic on the local lan subnet can only exit port 2.

Every attempt I have made so far results in no access between the ports at all or basic dumb swith behavior (any host on any port can get across all of the IP ranges).

First question here so please be kind. :) If you need more information I would be happy to provide it.

  • 1
    How have you attempted to separate traffic so far? ACLs, VLANs, etc? Also I'm assuming the carrier is tagging the different services. So Internet would be on, say, VLAN 10 and VPN on VLAN 20?
    – bigmstone
    Jun 21, 2013 at 18:09
  • Can you add a quick diagram of what exactly you're trying to do?
    – mellowd
    Jun 21, 2013 at 18:15
  • @bigmstone I think you might have hit it on the head. The carrier was all "oh just stick a switch in front and vlan it off" (they refused to elaborate on that, gotta love fly by night operations) I didn't think about the existing VLAN tags that may be coming out of the Adtrans. Sounds like its wireshark time. :)
    – TheMoo
    Jun 21, 2013 at 19:44
  • I'll post it as a formal answer so you can have some closure to the question.
    – bigmstone
    Jun 22, 2013 at 0:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 3, 2021 at 4:43

2 Answers 2


Depending on how the service is delivered by the SP will dictate how you can separate the services on your end.

Typical methods are either a port per service or a VLAN tag per service.

If the SP is tagging the traffic you can just set up your switch to trunk to the SP and then separate the traffic into two access ports (one to FW and one to LAN).

If it's a port per service then just create two VLANs with the services in different VLANs for isolation.


Assuming the Adtran is not using VLAN, I would establish a transport network between the Adtran Router and the Firewall (maybe using the one that is already existing on the Adtran interface).

Having done that, you only need to add routes on the Firewall to cover all your communication needs (default gateway pointing to the Adtran).

Afterwards you can connect everything else behind your firwall so that it is protecting your networks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.