1

Can we set filewall rule to control with in subnet? Network diagram

as in picture Can we use firewall to controll PC0 to access only some port on PC1 ? if we set gateway to router , Is it will alway go to router first? In my understanding this 2 PC ( PC0 + PC1 ) can see each other via only switch so they traffic will not pass firewall Is this correct?

and also if we use 2 subnet on same interface Is this effect to firewall rule? same port inrouter we set both ip on same interface 172.17.2.1and 172.17.2.1 as a gate way of both network and have only 1 cable to attached to firewall from router side . Is this ok or we need to seperate port for each subnet or not ?

3

The firewall will only be involve when subnet A communicates with subnet B.

It's possible to setup multiple subnets on one interface, but your layer-3 must on the Fortigates. (as a secondary IP address)

In short, if the communication is from PC 1 to PC 2, and they are on the same subnet, the firewall will not be involved.

5
  • Thank you .OK clear on that first point . but another point What do you mean layer3 must on the fortigates. (Secundary ip address) ?
    – Anue
    Sep 20 '19 at 7:35
  • 1
    vlan is a layer 2, and IP address is layer 3 I prefer layer3 on your firewall and not on the router. With secundary ip on the firewall you can config the same subnet on the same layer2
    – Elisa9180
    Sep 20 '19 at 7:35
  • Thank you, Then I should better set gateway IP to firewall instead?
    – Anue
    Sep 20 '19 at 7:40
  • 1
    Yes that's what i would do. Don't forget +1 😉
    – Elisa9180
    Sep 20 '19 at 7:45
  • Thank you more clear now .
    – Anue
    Sep 20 '19 at 8:07
3

You can do it with a software firewall, such as Windows Firewall, Linux IPtables/firewalld/etc. on the hosts themselves. That, unfortunately, is off limits for discussion on this site.

Aside from that, you have a few options. You could:

  • Use "Private VLANs" to isolate the traffic for those two hosts, but that is unnecessarily complicated to do for this task. You would do this on the switch that both of those hosts are connected to.

  • Use VACLs (VLAN ACLs) to filter on a VLAN (layer-2) level, as opposed to RACLs (Router ACLs), which is what you're used to on firewalls and most of the time on routers and switches to filter at a layer-3 level. You would do this on the switch that both of those hosts are connected to.

2
  • Thank you very much . I will study how to use VLAN to control that.
    – Anue
    Sep 23 '19 at 6:45
  • 1
    Here is a Cisco doc explaining how to configure VACLs and giving examples. Link
    – Jesse P.
    Sep 23 '19 at 10:48
1

Can we set filewall rule to control with in subnet?

Generally, a firewall can only control the traffic that's running across it. Usually, traffic within a subnet just crosses switches, so any traffic control would need to happen there (using ACLs).

and also if we use 2 subnet on same interface Is this effect to firewall rule?

Somewhat. Different IP subnets need to use a gateway in between, even if they are in the same L2 segment. That gateway can be used to control the traffic.

However, since the nodes in different subnets can easily bypass the gateway (by simply joining the other subnet with a secondary IP address) you have no 'real' control. It's highly recommended to use VLANs to separate L3 subnets into distinct L2 segments.

3
  • Thank you very much , Can you help me for more explain about "by simply joining the other subnet with a secondary IP address" ? My understanding is both subnet (even on the same interface as secondary IP ) this network will go through the interface and through the firewall , I do not understand How it can bypass the gateway?
    – Anue
    Sep 23 '19 at 6:32
  • 1
    When a host is on subnet A but you add a secondary IP on subnet B it can talk to B's hosts directly, without using a gateway/firewall. If subnet A and subnet B are in distinct L2 segments (VLANs) that is not possible.
    – Zac67
    Sep 23 '19 at 9:05
  • Thank you very much for information.
    – Anue
    Sep 26 '19 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.