VLAN and firewall interconnection

Question

I'm encountering some difficulties to connect some VLANs to a physical firewall.

In details I have a core network with a L3 switch as a router and some L2 switches as access network. The network is composed of 5 VLANs.

I'm looking for connect a firewall on the core and filter only 2 VLAN over 5 (to forward them to a distant site).

I tested some of these solutions :

• Disable the routing on the L3 switch for the councerned VLANs and enable it on the firewall + trunk link
• Create a "Firewall" VLAN, add it to the routing table and enable a access port on the core switch connected to the firewall --- ...

EDIT : details

One can modelize the subnets as follow : VLAN X = 10.0.X.0/24

I connect the firewall to the L3 switch (cisco) via the port number 24. I want to make accessible from a distant site (with another FW and IPsec link) the vlan number 2 and 3.

What is the best solution between :

1. Configure the port 24 as trunk + create 2 subinterfaces with dot1q respectively for VLAN 2 &3. Configure the firewall port with trunk, native vlan 2.
2. Create a "firewall" VLAN as 20.0.1.0/24 (GW 20.0.1.253). Let the port 24 on the switch as access port. Let the firewall port on the subnet 20.0.1.0/24 (GW 20.0.1.254). Let the switch make the interVLAN routing.

I'm quite lost and I'm looking for the best solution to achieve this

Regards

Answer 1

You haven't specified which kind of firewall you're using, so we can only provide general advice.

You can either use a separate connection for each VLAN between the central switch and the firewall - not really efficient -, or you can use a VLAN trunk to connect multiple, tagged VLANs through a single physical link.

For a VLAN trunk, you generally need to configure both sides of a link in the same way. On a switch, you put the switch port in trunk mode and optionally define which specific VLANs may cross the trunk.

A firewall is usually modeled as a router which doesn't use switch ports. Instead, you add logical subinterfaces to a routed port which takes care of the necessary tagging on the VLAN trunk.

It is possible to run a single VLAN as untagged on a VLAN trunk, but you need to configure the exact same VLAN on the switch side (the native VLAN) and on the router side (the routed port itself). Very often it's simpler and less error-prone to tag all VLANs.

To check VLAN connectivity it's very helpful to check the switch's MAC table for a VLAN. If it doesn't show the router's MAC address then the VLAN config isn't working.

For completeness: you don't need to deactivate routing on the L3 switch since you can connect any number of routers to a subnet (at least while testing). Just make sure you don't use asymmetric routing (different gateways in different directions) or know what special handling that may require.

EDIT You can connect all relevant VLANs to the firewall/router directly or you can use an intermediate routing subnet between the L3 switch and the firewall. There's no "best practice" for this. If you do use an intermediate subnet, make sure your firewall learns about the subnets that it's not connected to ("behind" the L3 switch), either by setting static routes or a routing protocol like OSPF between the gateways.

In regard to where to route: I like routing internal, inter-VLAN communication on an L3 switch (because it's fast and doesn't have a session limit) and external traffic through the firewall. For that, you point the end nodes' default gateway towards their respective SVI and the L3 switch's default route towards the firewall/WAN router.

If need be, you can filter traffic on an L3 switch as well using ACLs, albeit only in a stateless fashion. If that doesn't match your security requirements you need to run everything through the firewall. Do make sure that the firewall's session capacity is sufficient for all your internal traffic! Routing everything on the firewall reduces your L3 switch to L2 functionality.