I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several peripherals (a printer, a scanner, etc.), and of course managing the network switch and firewall themselves.
My goal is to configure the switch and firewall to achieve full isolation, for security. Only these flows should be allowed:
- PCs to Internet, inspected by the firewall
- PCs to peripherals, through the firewall
- PCs to network device management (firewall and switch)
- VoIP phone to Internet, through the firewall
I want to prevent any and all traffic between PCs. And of course prevent from peripherals to PCs.
What is the best way to configure this?
Here's where I'm up to:
VLANs & subnets
- VLAN 2 for PCs
- VLAN 3 for phones
- VLAN 4 for peripherals
- VLAN 5 for network device management
Each VLAN corresponds to a subnet (10.1.2.0/24 for VLAN 2, 10.1.3.0/24 for VLAN 3, etc.)
- All PC, phones, and peripheral ports are private VLAN edge / protected ports
- 1 connection to firewall NIC 2 on VLAN 2 *
- 1 connection to firewall NIC 3 on VLAN 3 *
- 1 connection to firewall NIC 4 on VLAN 4 *
- 1 connection to firewall NIC 5 on VLAN 5 *
* I think these ports should be promiscuous trunk ports, but am not sure; please advise
- NIC 1 WAN (Internet) Layer 3 DHCP
- NIC 2 Layer 3 interface, with subinterface on VLAN 2 with IP 10.1.2.1 ***
- NIC 3 Layer 3 interface, with subinterface on VLAN 3 with IP 10.1.3.1
- NIC 4 Layer 3 interface, with subinterface on VLAN 4 with IP 10.1.4.1
- NIC 5 Layer 3 interface, with subinterface on VLAN 5 with IP 10.1.5.1
*** My understanding is that configuring a VLAN subinterface tells the firewall to only pass it traffic that matches a certain VLAN
All firewall interfaces are configured for routing between them
- Allow NIC 2 / VLAN 2 --> NIC 1
- Allow NIC 2 / VLAN 2 --> NIC 4 / VLAN 4
- Allow NIC 2 / VLAN 2 --> NIC 5 / VLAN 5
- Allow NIC 3 / VLAN 3 --> NIC 1
Will this configuration work? Will it block all internal traffic, except the very specifically allowed, on the LAN?