I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several peripherals (a printer, a scanner, etc.), and of course managing the network switch and firewall themselves.

My goal is to configure the switch and firewall to achieve full isolation, for security. Only these flows should be allowed:

  1. PCs to Internet, inspected by the firewall
  2. PCs to peripherals, through the firewall
  3. PCs to network device management (firewall and switch)
  4. VoIP phone to Internet, through the firewall

I want to prevent any and all traffic between PCs. And of course prevent from peripherals to PCs.

What is the best way to configure this?

Here's where I'm up to:

VLANs & subnets

  • VLAN 2 for PCs
  • VLAN 3 for phones
  • VLAN 4 for peripherals
  • VLAN 5 for network device management

Each VLAN corresponds to a subnet ( for VLAN 2, for VLAN 3, etc.)


  • All PC, phones, and peripheral ports are private VLAN edge / protected ports
  • 1 connection to firewall NIC 2 on VLAN 2 *
  • 1 connection to firewall NIC 3 on VLAN 3 *
  • 1 connection to firewall NIC 4 on VLAN 4 *
  • 1 connection to firewall NIC 5 on VLAN 5 *

* I think these ports should be promiscuous trunk ports, but am not sure; please advise

Firewall Interfaces:

  1. NIC 1 WAN (Internet) Layer 3 DHCP
  2. NIC 2 Layer 3 interface, with subinterface on VLAN 2 with IP ***
  3. NIC 3 Layer 3 interface, with subinterface on VLAN 3 with IP
  4. NIC 4 Layer 3 interface, with subinterface on VLAN 4 with IP
  5. NIC 5 Layer 3 interface, with subinterface on VLAN 5 with IP

*** My understanding is that configuring a VLAN subinterface tells the firewall to only pass it traffic that matches a certain VLAN

All firewall interfaces are configured for routing between them

Firewall rules:

  • Allow NIC 2 / VLAN 2 --> NIC 1
  • Allow NIC 2 / VLAN 2 --> NIC 4 / VLAN 4
  • Allow NIC 2 / VLAN 2 --> NIC 5 / VLAN 5
  • Allow NIC 3 / VLAN 3 --> NIC 1

Will this configuration work? Will it block all internal traffic, except the very specifically allowed, on the LAN?

  • 5
    There is no "100% security" when you allow any connection elsewhere.
    – Zac67
    Commented Jan 27, 2020 at 8:02
  • If you allow VLAN 2 to VLANs 4 and 5, you must also allow VLANs 4 and 5 to to VLAN 2, and any VLAN to the WAN must allow the WAN to the VLAN. Remember that almost every application protocol is bidirectional, so requests going out need rules to allow replies to come back.
    – Ron Maupin
    Commented Jan 27, 2020 at 10:20
  • @RonMaupin This is a stateful firewall, which can track which side initiated the session. If A -> B is allowed, then it will allow B to respond to A but not initiate a new session. Commented Jan 27, 2020 at 22:35
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Dec 17, 2020 at 15:17

3 Answers 3


Putting aside the impossibility of 100% security, your plan seems sound. Of course, everything depends on the policies on the firewall. To answer your specific questions, yes, the switch ports to the firewall are promiscuous, and configuring a VLAN on (most) firewalls creates a separate logical interface.


Find the 100% security is basically impossible, however there is something that could help you that is the interface isolation. This means that you use network cards (interfaces) specific for user data, management and others, and you don't mix them. This is not possible all times but prevents issues such as the management of the VLANs as well as complex firewall rules related to vlan that may generate issues.


According to your requirement chosee the devices required Generally a network engineer motive should always be optimised , scalable realiable, secure network design and implementation ...

  1. Router(Edge router)
  2. Firewall(perimeter firewall)
  3. L3 switch(core switch)
  4. L2 switch (access switch)


ISP internet link should land the this router , DNS forwarded can be configured in this router

1 ) Default route pointing to ISP gateway should configured on router

  1. default route pointing to firewall egress interfàce gateway should configured


This firewall is used for NAT and PAT configuration for outbound internet access traffic . And for configuring security policies enabling security features like webfilterring , antivirus, IPS & IDS features .

L3 switch

Switch virtual interfàce (SVI) can be configured on this switch for VLAN and enable inter-Vlan routing and configure access -list accordinglly to restrict traffic among Vlan as per your requirement

L2 switch

This switch is used to connect end devices like laptops , desktops by allocating access-ports and passing required Vlans as per requirement..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.