2

I am designing a network consisting of close 60 ports, via a managed switch. I intend to deploy multiple VLANs: one for servers, one for desktops, one for guests, etc.

I intend to use the firewall to route between VLANs. (Yes, that's expensive, but in our case, we want to do it).

Does each VLAN need its own dedicated uplink port on the switch and firewall (acting as a router)? That is, if I want 6 VLANs, do I need to configure one port on the switch for each VLAN, and connect each to a different port on the firewall? Or should I use trunking, and send them all to the firewall on the same port? How do I enforce different security for those VLANs (ideally, I'd like physically distinct ports, not just VLAN tagging).

Also, do I need to create management VLANs (for the switch and firewall themselves)?

Improve this question

2 Answers 2

Reset to default
2

You need to start by evaluating the capacity of your firewall. If you firewall is only good for a several hundred megabits of throughput, then I would trunk all 6 vlans on one interface with 802.1q tagging to the firewall. (You mention you want physical ports, not just vlan tagging, but technically there is no security difference between the two, and physical ports is just wasteful.)

If, however, your firewall can do more than a gigabit of throughput, then it makes sense to take a couple ports and port-channel them together, and make that into a 802.1q trunk. Then, you'll be able to take advantage of more throughput capacity on the firewall.

To reiterate, using separate ports in different vlans is exactly the same as trunking multiple vlans over a single port. The 802.1q tags keep the traffic in their correct vlans.

Regarding management vlans, you're opening a religious discussion. I would suggest just managing the devices in-band, but there are a lot of people who will vehemently argue for using a dedicated management vlan. To each his own!

Improve this answer
2
  • To clarify, are you saying: 1. Don't bother with physical port isolation, just use trunking on the same port. And 2. If the capacity of your firewall is > than the speed of your port, use multiple ports under link aggregation? (My feeling is that #1 makes it easier and less to go wrong, because you have distinct ports; and #2 isn't an issue because I can use the 1 Gbps to connect to the firewall.)
    – SRobertJames
    Jul 10, 2018 at 0:15
  • Yes, your summary is correct on points 1 and 2. Regarding your thought on physical isolation being less to go wrong, you actually have more things that could go wrong with multiple physical ports. More cables to wiggle loose, more ASICs to fail, etc. And from a configuration perspective, there are more ports to become misconfigured or go into error-disable. There are some advantages to distinct cables, in that you can have partial failure versus complete failure. Take your pick.
    – user3629081
    Jul 10, 2018 at 1:38
1

Does each VLAN need its own dedicated uplink port on the switch and firewall (acting as a router)?

If both sides support 802.1Q VLAN tagging you can set up a single VLAN trunk (or aggregated ports) for all VLANs. One of the VLANs may be untagged (sometimes called the native VLAN), all the others must be tagged on both side in the same manner.

Make sure you provide sufficient bandwidth for the trunk. It may be necessary to set up multiple, aggregated ports (e.g. using LACP) or run multiple trunks with grouped VLANs. The latter in combination with spanning tree requires MSTP and proper instance configuration.

Sufficient bandwidth allocation includes the firewall. It needs to be able to forward with the required speed.

How do I enforce different security for those VLANs (ideally, I'd like physically distinct ports, not just VLAN tagging).

Usually, all nodes in a VLAN can talk to each other. Separating them requires a feature like private VLAN or source port filtering on the connecting switch. It's also possible to set up ACLs to filter unwanted IP traffic.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.