IP Routing and Switching Interface Speeds

Question

I have a question that relates to routing and switches. I am looking to set up a new Firewall that will handle the routing for the network and attached to the Firewall will be a switch. Here are the details:

Firewall/Router (FW)

FW Port 1 -> VLAN 10 & 20

VLAN 10: 192.168.15.x/24 (Server LAN)

VLAN 20: 10.0.0.x/24 (User LAN)

This FW port will have two subnets attached to it as referenced above, VLAN 10 and 20 will be on the same interface. The interface runs at 1GB.

Switch (SW)

For simplicity let’s say the switch has 11 ports. Every port on this switch runs at 10GBs.

SW Port 11 -> FW Port 1

SW Port 11 is set as a trunk port and will connect to the FW and will pass all VLANS, 10 & 20.

Since the FW Port 1 runs at 1 GB the SW Port 11 will go from 10GB to 1GB to match the port speed.

SW Ports 1 thru 5 -> Assigned VLAN 10

SW Ports 6 thru 10 -> Assigned VLAN 20

Questions

Since the FW is handling the routes I am not sure how this affects my network speeds.

1. As an example let’s say I’m on the Server LAN (VLAN 10) with a Server connected to port 1 and I need to communicate with a server on port 3, since they are on the same broadcast domain the switch will send the data from port 1 to port 3 @ 10GBs and not need to hit the FW, is this correct?
2. In this second scenario, I’m on the Server LAN (VLAN 10) with a Server connected to port 1 and I need to communicate with the user LAN (VLAN 20) with a desktop on port 8. Because there are two subnets involved the FW routing will come into play and again my question relates to the speeds. Since the SW ports run @ 10GB and the FW port runs @ 1GB will the connection be limited to 1GB speeds? A better illustration would be if I transfer a 100GB file from Server LAN (VLAN 10) to user LAN (VLAN 20) and it has to hit the FW for route discovery is my transfer going to be 10GB or 1GB? I’m trying to understand if the FW port will cause my network to go slower since it is handling the routes?

thanks

Answer 1

1. As an example let’s say I’m on the Server LAN (VLAN 10) with a Server connected to port 1 and I need to communicate with a server on port 3, since they are on the same broadcast domain the switch will send the data from port 1 to port 3 @ 10GBs and not need to hit the FW, is this correct?

That is correct.

2. In this second scenario, I’m on the Server LAN (VLAN 10) with a Server connected to port 1 and I need to communicate with the user LAN (VLAN 20) with a desktop on port 8. Because there are two subnets involved the FW routing will come into play and again my question relates to the speeds. Since the SW ports run @ 10GB and the FW port runs @ 1GB will the connection be limited to 1GB speeds? A better illustration would be if I transfer a 100GB file from Server LAN (VLAN 10) to user LAN (VLAN 20) and it has to hit the FW for route discovery is my transfer going to be 10GB or 1GB? I’m trying to understand if the FW port will cause my network to go slower since it is handling the routes?

The path will be limited to the slowest link in the path, which will be 1 Gbps. That will be the case for any traffic that needs to be routed from one network to the other network.

---

The best way to handle this is to have a layer-3 switch (your 10 Gbps switch will probably be a layer-3 switch) handle the LAN routing, and simply use the firewall as a WAN router. Your WAN connection will probably be 1 Gbps or less so the lower speed of the firewall interfaces would not really matter in that situation.