I am working on setting up VLANS on a basically default switch configuration for my SMB network. They have 5 juniper ex2200 switches that are all on the same subnet and have only a default vlan. I want to do switch stacking via junos Virtual Chassis as well as VLANS.

As of now, only one switch is physically connected to my netgate/pfsense firewall gateway appliance also residing on the same subnet which acts as the DHCP server and default gateway for all nodes in our LAN ( 254 ip addresses all in 10.235.17.***/24).

The remaining switches are all consolidated into ports in the main switch and radiate out from this central point.

What I am unsure about is with the switch stacking I plan on doing should I configure vlans in my netgate at layer 3, or implement it on my switches at layer 2?

  • VLANs generally work at layer 2. When you configure VLANs on a layer-3 (non-switched) interface each interface has its own, disconnected set of VLANs. – Zac67 Apr 14 '20 at 19:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 16 '20 at 23:17

If you want your firewall to be able to restrict traffic exchanged among your various VLANs, you should do your layer-3 configuration on the firewall.

If you don't want any limits on, for example, PCs or phones communicating with servers or security cameras in other VLANs, you can do layer-3 on your switches.

There is a trade-off involved. As you are most likely aware, your firewall has less interface bandwidth, and less forwarding capacity, than the switches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.