I'm encountering some difficulties to connect some VLANs to a physical firewall.
In details I have a core network with a L3 switch as a router and some L2 switches as access network. The network is composed of 5 VLANs.
I'm looking for connect a firewall on the core and filter only 2 VLAN over 5 (to forward them to a distant site).
I tested some of these solutions :
- Disable the routing on the L3 switch for the councerned VLANs and enable it on the firewall + trunk link
- Create a "Firewall" VLAN, add it to the routing table and enable a access port on the core switch connected to the firewall --- ...
EDIT : details
One can modelize the subnets as follow : VLAN X = 10.0.X.0/24
I connect the firewall to the L3 switch (cisco) via the port number 24. I want to make accessible from a distant site (with another FW and IPsec link) the vlan number 2 and 3.
What is the best solution between :
- Configure the port 24 as trunk + create 2 subinterfaces with dot1q respectively for VLAN 2 &3. Configure the firewall port with trunk, native vlan 2.
- Create a "firewall" VLAN as 20.0.1.0/24 (GW 20.0.1.253). Let the port 24 on the switch as access port. Let the firewall port on the subnet 20.0.1.0/24 (GW 20.0.1.254). Let the switch make the interVLAN routing.
I'm quite lost and I'm looking for the best solution to achieve this
Regards