2

Note: This is not a project of an existing or future real network but only my laboratory in GNS3.

Hey,
I have a network project presented as in the diagram where:

  • pfSense works as a firewall and NAT
  • Windows Server takes over DHCP and DNS roles and introduces AD (we assume that it has only one interface)

Now I would like to divide the network globally into 2 VLANs:  

  • Core (2), which will contain only pfSense and Windows Server (to secure direct access to pfSense)
  • Access (3), which will contain Windows Server and the rest of the network bypassing pfSense.

TL;DR;
WAN / ISP -> pfSense WAN
pfSense LAN -> Switch
Switch -> Server
Switch -> all LAN devices

enter image description here

And now I have a dilemma - how is it best to manage VLANs in such a network assuming that Windows Server serves DHCP?

btw. Does anyone know what this program offers such diagrams? :)

Improve this question
4
  • 1
    What do you mean by "manage VLANs?" Conceptually, a VLAN is another physical switch. To get traffic from one VLAN to another, the traffic must be routed, either with a router or a layer-3 switch.
    – Ron Maupin ♦
    Feb 4, 2018 at 16:26
  • @RonMaupin Sorry for not specifying. I mean in general about VLANs, where is the best way to put a router for them? To pfSense connect it and from it 2 outputs: one for the server and the other for the switch for the rest of the network or maybe you have some other proposal?
    – Vertisan
    Feb 4, 2018 at 16:38
  • You could create a virtual interface for each VLAN in your router, and the link from the router to the switch is a trunk. Alternatively, you can use a layer-3 switch, with a virtual interface for each VLAN, and a routed link to the router.
    – Ron Maupin ♦
    Feb 4, 2018 at 16:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 31, 2020 at 4:35

2 Answers 2

Reset to default
1

Aparrently, you want the server to be present in both VLANs, so it will require a second network interface. This can be a physical NIC or a VLAN subinterface on the present NIC.

When you split the LAN between firewall and clients and still want to provide Internet access to the clients, a router is required to allow communication. For instance you can use a layer 3 switch to connect them and set up routing there.

Since the server is connected to the client VLAN it can provide DHCP service directly.

Improve this answer
0

Its feasible

Create two sub-interfaces in firewall with two vlan and connect downstream switch . Configure trunk link in switch allowing all Vlan passes through this link .

Further configure access port on access switch and tagged required Vlans and connect DHCP server and client mechines accordinglly.

Now requirment is to DHCP server need to communicate remaining Vlan connected devices to fullfill this requirement . A security policy need to frame in firewall as

Souces address : DHCP server ip address

Destination address : remaining Vlan subnet

Direction : bidirectional

Action :Allow .

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.