1

I am working on setting up VLANS on a basically default switch configuration for my SMB network. They have 5 juniper ex2200 switches that are all on the same subnet and have only a default vlan. I want to do switch stacking via junos Virtual Chassis as well as VLANS.

As of now, only one switch is physically connected to my netgate/pfsense firewall gateway appliance also residing on the same subnet which acts as the DHCP server and default gateway for all nodes in our LAN ( 254 ip addresses all in 10.235.17.***/24).

The remaining switches are all consolidated into ports in the main switch and radiate out from this central point.

What I am unsure about is with the switch stacking I plan on doing should I configure vlans in my netgate at layer 3, or implement it on my switches at layer 2?

Improve this question
2
  • VLANs generally work at layer 2. When you configure VLANs on a layer-3 (non-switched) interface each interface has its own, disconnected set of VLANs.
    – Zac67 ♦
    Apr 14, 2020 at 19:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 16, 2020 at 23:17

2 Answers 2

Reset to default
0

should I configure vlans in my netgate at layer 3, or implement it on my switches at layer 2?

Both.

Configuring VLANs on the switches separates those subnets from each other, so they can't communicate with each other without a router/gateway.

From the center switch, configure the link to the pfSense as a VLAN trunk, with all VLANs tagged. On the pfSense, configure a (layer-3) subinterface for each VLAN. That way, you can use the pfSense as gateway between the VLANs and control that traffic.

Alternatively (esp. when more bandwidth is required than the pfSense can handle), you can configure the center switch for layer 3 forwarding (routing) between the VLANs, using appropriate ACLs for traffic control - not sure about the EX 2200, but L3 switch ACLs are usually stateless, so rules in either direction might be required.

Improve this answer
0

If you want your firewall to be able to restrict traffic exchanged among your various VLANs, you should do your layer-3 configuration on the firewall.

If you don't want any limits on, for example, PCs or phones communicating with servers or security cameras in other VLANs, you can do layer-3 on your switches.

There is a trade-off involved. As you are most likely aware, your firewall has less interface bandwidth, and less forwarding capacity, than the switches.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.