When looking at the image, the Switch is routing capable (L3) and is the default gateway for clients in the LAN. We plan to introduce a new Firewall and stand before the question if we should give its LAN interface an IP address of the LAN subnet or if we should create a separate transfer subnet between Routing Switch and Firewall? Are there any pros/cons or does it not matter?

enter image description here

2 Answers 2


An L3 switch usually routes at wire speed, so pointing the clients' default gateway to the core switch doesn't cost you anything (ie. no extra L2 hop). That default gateway is also advantageous if there are other gateways leading elsewhere (security zones, other buildings, ...) that you don't want to bother the firewall with.

Connecting the firewall doesn't necessarily require a transfer subnet. You can just as well put in on the same subnet as the core switch - unless you don't want the clients to connect directly, of course.

For maximum flexibility, I'd trunk all VLANs to the firewall. Then you can set (and allow) the default gateway that works best for your performance and security requirements (and possibly deny/filter the other gateway/router).

  • Thanks for your answer. What do you mean by "connect directly"? That someone could manually set the Firewall as default Gateway in his computer? Jan 26, 2021 at 12:30
  • Yes - "access directly" would be more precise perhaps. You could filter those clients by source MAC, of course.
    – Zac67
    Jan 26, 2021 at 14:52
  • thanks! As no ACLs are defined on the routing switch, this would not really matter, right? Because the router only forwards the packets anyway. And for admin access usually on the Firewall you can restrict access to certain hosts Jan 26, 2021 at 15:15
  • Sure, it all depends on your firewall requirements.
    – Zac67
    Jan 26, 2021 at 16:37
  • another thing I just thought about is that we will have different kind of VLANs on the routing switch. So if I don't want to configure the connection between firewall and switch as a trunk, then a separate transfer subnet could help, right? Then I would simply configure the port on the switch that is connected to the firewall as an access port? Jan 28, 2021 at 15:49

If default gateway of clients is configured on switch . Then you can use another ip address to configure on interfaces connecting firewall and switch and ensure

  1. specific route Configured in firewall pointing towards. Switch ingress interface.

  2. default route need to configure on switch pointing towards ingress interfàce of firewall .

But make sure your switch is layer3 switch . So that ip address can assigned to interfaces connecting switch and firewall and you can even create Vlans and isolate traffic among VLANs in future .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.