0

I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several peripherals (a printer, a scanner, etc.), and of course managing the network switch and firewall themselves.

My goal is to configure the switch and firewall to achieve full isolation, for security. Only these flows should be allowed:

  1. PCs to Internet, inspected by the firewall
  2. PCs to peripherals, through the firewall
  3. PCs to network device management (firewall and switch)
  4. VoIP phone to Internet, through the firewall

I want to prevent any and all traffic between PCs. And of course prevent from peripherals to PCs.

What is the best way to configure this?

Here's where I'm up to:

VLANs & subnets

  • VLAN 2 for PCs
  • VLAN 3 for phones
  • VLAN 4 for peripherals
  • VLAN 5 for network device management

Each VLAN corresponds to a subnet (10.1.2.0/24 for VLAN 2, 10.1.3.0/24 for VLAN 3, etc.)

Switch:

  • All PC, phones, and peripheral ports are private VLAN edge / protected ports
  • 1 connection to firewall NIC 2 on VLAN 2 *
  • 1 connection to firewall NIC 3 on VLAN 3 *
  • 1 connection to firewall NIC 4 on VLAN 4 *
  • 1 connection to firewall NIC 5 on VLAN 5 *

* I think these ports should be promiscuous trunk ports, but am not sure; please advise

Firewall Interfaces:

  1. NIC 1 WAN (Internet) Layer 3 DHCP
  2. NIC 2 Layer 3 interface, with subinterface on VLAN 2 with IP 10.1.2.1 ***
  3. NIC 3 Layer 3 interface, with subinterface on VLAN 3 with IP 10.1.3.1
  4. NIC 4 Layer 3 interface, with subinterface on VLAN 4 with IP 10.1.4.1
  5. NIC 5 Layer 3 interface, with subinterface on VLAN 5 with IP 10.1.5.1

*** My understanding is that configuring a VLAN subinterface tells the firewall to only pass it traffic that matches a certain VLAN

All firewall interfaces are configured for routing between them

Firewall rules:

  • Allow NIC 2 / VLAN 2 --> NIC 1
  • Allow NIC 2 / VLAN 2 --> NIC 4 / VLAN 4
  • Allow NIC 2 / VLAN 2 --> NIC 5 / VLAN 5
  • Allow NIC 3 / VLAN 3 --> NIC 1

Will this configuration work? Will it block all internal traffic, except the very specifically allowed, on the LAN?

  • 5
    There is no "100% security" when you allow any connection elsewhere. – Zac67 Jan 27 at 8:02
  • If you allow VLAN 2 to VLANs 4 and 5, you must also allow VLANs 4 and 5 to to VLAN 2, and any VLAN to the WAN must allow the WAN to the VLAN. Remember that almost every application protocol is bidirectional, so requests going out need rules to allow replies to come back. – Ron Maupin Jan 27 at 10:20
  • @RonMaupin This is a stateful firewall, which can track which side initiated the session. If A -> B is allowed, then it will allow B to respond to A but not initiate a new session. – SRobertJames Jan 27 at 22:35
3

Putting aside the impossibility of 100% security, your plan seems sound. Of course, everything depends on the policies on the firewall. To answer your specific questions, yes, the switch ports to the firewall are promiscuous, and configuring a VLAN on (most) firewalls creates a separate logical interface.

| improve this answer | |
0

Find the 100% security is basically impossible, however there is something that could help you that is the interface isolation. This means that you use network cards (interfaces) specific for user data, management and others, and you don't mix them. This is not possible all times but prevents issues such as the management of the VLANs as well as complex firewall rules related to vlan that may generate issues.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.