Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Just wondering the theory or reason behind having the inside interface of a firewall on a different network than your primary network. I put together a quick drawing of what i'm talking about.
What is the advantage of having the inside interface of the firewall on a different subnet, than just being on a main subnet? In the diagram I have the inside interface as 172.16.1.2, which I see a lot in example diagrams. But what is the benefit of it just being another 
Usually firewall is a router, so normal configuration for router is have different subnets on different interfaces.
In Your diagram, as I guess, implied that LAN is private and WAN is public IP space, so "firewall" really do not only Firewall work (filtering) but also NAT-router work (routing and address translation).
But in some cases is useful to configure firewall as transparent bridge (switch) without making influence on subnets architecture.
Based on your diagram, the network inside the firewall is using private addressing, so NAT is needed to connect to the Internet. The NAT is performed on the firewall since it is unlikely that the core switch can do NAT. The core switch is likely a layer-3 switch, so the link to the firewall is probably a routed link.
Given a firewall and a layer-3 switch, you really want to do the routing on the layer-3 switch rather than the firewall. It may be possible to do the routing on the firewall, but why burden the processor on the firewall with all the services that routers may do, such as routing, QoS, NetFlow, etc., if your layer-3 switch can perform those services.
The diagram seems to be pretty simple, but you would really probably have multiple VLANs/subnets on the LAN side of the core switch.
Based on your diagram, there's no immediate advantage.
However, I suspect the internal network is more complex than a single, flat LAN. In that case, the "core switch" is the internal ("inter-vlan") router. It will be much faster at the task of routing than the firewall can ever be. For starters, the firewall is a single interface ("port"), where as the switch has dozens (if not hundreds) of ports.
In the diagram you posted, on the right it makes reference to Vlan10 with a 10.10.0.0/24 network. Based on that observation you can infer that there is a management network that is 172.16.1.x which would be setup to configure your devices.
This could be for security, you don't want just anyone at your company to be able to access your firewalls web gui, or switch SSH ports etc.
I think the separation of the interface from internal network creates an additional line of defense, which could be quite useful in case the firewall gets hacked. I mean, in addition to switching/routing, your Core switch could have some ACL-s that protect your internal resources and possibly regulate the access to the 172.16.x.x network. In fact, this separate network is a kind of DMZ.
