5

I have just started my new job as a network engineer and have come across an unusual request

I have an L2 network defined, the LAN is behind a Layer 2 switch, which is then connected to the WAN/MPLS router. I wish to deploy a firewall in this network.

Will the following setup work: LAN---L2 Switch---Firewall---ISP

Please note that L2 switch is not just connected to the LAN, it is also connected to a WAN Router to reach out to MPLS network as well. How to deploy this?

Improve this question
6
  • 4
    Cisco calls this "transparent mode". You can inspect and block traffic, but can't do things like NAT.
    – Ricky
    Nov 10, 2018 at 18:35
  • Well structured question. Theoretically, yes, it should work. That is, the LAN is connected to the internet just through the firewall.
    – محمد جعفر نعمة
    Nov 10, 2018 at 20:22
  • 1
    What is acting as the gateway for your LAN if all you have is a layer-2 switch currently? Also, what is currently handling NAT? It may be beneficial for you to add the firewall in router mode rather than transparent to give you some more control over your environment.
    – Jesse P.
    Nov 11, 2018 at 3:33
  • Please add the L3 device that is the gateway for the LAN subnet ? Is it the L2 switch, the Wan Router(not in diagram) or some other device ?
    – Pieter
    Nov 18, 2018 at 0:10
  • Transparent mode (layer 2) firewalls are operationally more problematic than routing or NATing (layer3) firewalls. Presumably the box marked "ISP" is also doing NAT, so you could insert a routing firewall with just a little renumbering of your private network addressing. Better still might be to flip the "ISP" box into bridging mode and do the NAT on your firewall, as this gives substantially more control of traffic. It really comes down the capabilities of the "firewall" and "ISP" boxes.
    – vk5tu
    Nov 18, 2018 at 12:10

1 Answer 1

Reset to default
1

There are following descriptions to this kind of deployment of a firewall:

  • Bump (in|on) the wire
  • Layer2 firewall
  • Transparent firewall

There are many designs to find if searching for upper phrases. The deployment depends on the firewall vendor you are using.

One short article if using one specific firewall vendor is found here in the following article.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.