5

I have just started my new job as a network engineer and have come across an unusual request

I have an L2 network defined, the LAN is behind a Layer 2 switch, which is then connected to the WAN/MPLS router. I wish to deploy a firewall in this network.

Will the following setup work: LAN---L2 Switch---Firewall---ISP

Please note that L2 switch is not just connected to the LAN, it is also connected to a WAN Router to reach out to MPLS network as well. How to deploy this?

  • 4
    Cisco calls this "transparent mode". You can inspect and block traffic, but can't do things like NAT. – Ricky Beam Nov 10 '18 at 18:35
  • Well structured question. Theoretically, yes, it should work. That is, the LAN is connected to the internet just through the firewall. – Mohamad-Jaafar NEHME Nov 10 '18 at 20:22
  • 1
    What is acting as the gateway for your LAN if all you have is a layer-2 switch currently? Also, what is currently handling NAT? It may be beneficial for you to add the firewall in router mode rather than transparent to give you some more control over your environment. – Jesse P. Nov 11 '18 at 3:33
  • Please add the L3 device that is the gateway for the LAN subnet ? Is it the L2 switch, the Wan Router(not in diagram) or some other device ? – Pieter Nov 18 '18 at 0:10
  • Transparent mode (layer 2) firewalls are operationally more problematic than routing or NATing (layer3) firewalls. Presumably the box marked "ISP" is also doing NAT, so you could insert a routing firewall with just a little renumbering of your private network addressing. Better still might be to flip the "ISP" box into bridging mode and do the NAT on your firewall, as this gives substantially more control of traffic. It really comes down the capabilities of the "firewall" and "ISP" boxes. – vk5tu Nov 18 '18 at 12:10
1

There are following descriptions to this kind of deployment of a firewall:

  • Bump (in|on) the wire
  • Layer2 firewall
  • Transparent firewall

There are many designs to find if searching for upper phrases. The deployment depends on the firewall vendor you are using.

One short article if using one specific firewall vendor is found here in the following article.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.