1

Updated Network Diagram

The Question: What is the proper configuration for the L3 switch to be allowed to assign public IPs for the firewalls?

I guess All I need is that the switch L3 act as a layer 2 switch...Right?

Update 1- The Same ISP provides two public subnets /29 ( wan 1 and wan 2) 2- SFP connectors are connected to Cisco 3650 3- The Firewalls are Fortigate and they are working as Routers (NAT Mode).

I just need to know:

  1. what is the ports configuration on the layer 3 switch that will be connected to the ISP?

  2. what is the ports configuration on the layer 3 switch that will be connected to the Firewalls? Or any device will be connected directly to the L3 switch to have a public IP?

  • 1
    That depends on several factors. You need to give us more information. We don't even know what the switch model is, so there is no way to give you a configuration, but we also need to know a lot more about the ISP connection. Is it a single connection to one ISP, multiple connections to one ISP, or single connections to two ISPs? Can the firewalls be configured as transparent firewalls? You need to include all the relevant information. – Ron Maupin Jul 17 '17 at 22:49
  • Sorry for my bad descriptions. I updated my question. Thank you for your response. – Basem Abdulrahem Jul 18 '17 at 14:17
  • I'm not convinced that your network design is really correct. If you are going to introduce a SPoF (Single Point of Failure) by using the single switch, then why not just use a single firewall for both ISP connections? Then, you could eliminate the (unprotected) switch. Also, if the firewalls are doing the routing, why do you need routers inside the firewalls? Also, you don't normally connect the hosts directly to the routers. Could it be that those are switches? I believe you may be overthinking this. I would probably go with a single firewall and layer-3 switches inside for the routing. – Ron Maupin Jul 18 '17 at 14:50
  • What is your reason for using a switch here? Media converter? Do you need to run BGP with your ISP? – Ron Trunk Jul 18 '17 at 15:06
  • 1
    Well if you don't know the credentials of the switches, you cannot configure them. You probably want a VLAN for each ISP network (assuming the two connections are separate networks), or one VLAN if the two connections use the same network. You will need to be able to log into the switches to create the VLAN(s). – Ron Maupin Jul 18 '17 at 17:44
2

Generally, you'd want to avoid plugging a switch directly into the ISP (even a layer 3) but if your Fortigate is acting as a router, you can use the switch by doing the following:

Assign it one of the IP's from your ISP. Switch your links to trunk link connecting to the router, and access links to the end users. Set your default gateway (including your gateway of last resort back to the ISP) and you should have a bare bones network.

You can spread out and run VLANs, but I would start with it as easy as possible, make sure it works, then add customization one piece at a time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.