Router port facing to Core switch is running trunk mode allowed vlan 200 & 300. I am placing a firewall between the trunk connection. Can I set the firewall as L2 transparent mode or I need to configure the firewall as trunk mode for both ports? The setup i was wondering whether firewall normal switchport interface can it talk to the router port trunk mode? It is like connecting a PC/L2 switch to the router trunk port. I was wondering whether it works and concept behind. Thanks guys! I need help!

1)Does it mean that fw in transparent mode, the trunk status for Router and Core switch still UP? However the firewall will not be able to do any policy or rules since it doesnt understand tagged frame? If so, Traffic from core switch to router still goes through without issue in fw L2 transparent mode?

2)Does it mean that The firewall port facing to core switch and router has to be configured as trunk port(allowed all VLANs), only then it can filter the traffic using its fw policy?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 19:59

This depends on the firewall you have in mind. Depending on the type and possibly its settings, there are several possibilities:

  • the firewall forwards all traffic and examines all traffic (practically ignoring VLAN tags)
  • the firewall forwards all traffic but examines only untagged traffic (ignoring tagged frames)
  • the firewall only forwards and examines untagged traffic and drops all tagged frames

You'll have to consult the manual or tell us the type of firewall and its configuration.

Both switch ports up- and downlinking the firewall need to be in trunk mode to send and accept tagged frames.

Not the answer you're looking for? Browse other questions tagged or ask your own question.