I'm encountering some difficulties to connect some VLANs to a physical firewall.

In details I have a core network with a L3 switch as a router and some L2 switches as access network. The network is composed of 5 VLANs.

I'm looking for connect a firewall on the core and filter only 2 VLAN over 5 (to forward them to a distant site).

I tested some of these solutions :

  • Disable the routing on the L3 switch for the councerned VLANs and enable it on the firewall + trunk link
  • Create a "Firewall" VLAN, add it to the routing table and enable a access port on the core switch connected to the firewall --- ...

EDIT : details

One can modelize the subnets as follow : VLAN X = 10.0.X.0/24

I connect the firewall to the L3 switch (cisco) via the port number 24. I want to make accessible from a distant site (with another FW and IPsec link) the vlan number 2 and 3.

What is the best solution between :

  1. Configure the port 24 as trunk + create 2 subinterfaces with dot1q respectively for VLAN 2 &3. Configure the firewall port with trunk, native vlan 2.
  2. Create a "firewall" VLAN as (GW Let the port 24 on the switch as access port. Let the firewall port on the subnet (GW Let the switch make the interVLAN routing.

I'm quite lost and I'm looking for the best solution to achieve this


1 Answer 1


You haven't specified which kind of firewall you're using, so we can only provide general advice.

You can either use a separate connection for each VLAN between the central switch and the firewall - not really efficient -, or you can use a VLAN trunk to connect multiple, tagged VLANs through a single physical link.

For a VLAN trunk, you generally need to configure both sides of a link in the same way. On a switch, you put the switch port in trunk mode and optionally define which specific VLANs may cross the trunk.

A firewall is usually modeled as a router which doesn't use switch ports. Instead, you add logical subinterfaces to a routed port which takes care of the necessary tagging on the VLAN trunk.

It is possible to run a single VLAN as untagged on a VLAN trunk, but you need to configure the exact same VLAN on the switch side (the native VLAN) and on the router side (the routed port itself). Very often it's simpler and less error-prone to tag all VLANs.

To check VLAN connectivity it's very helpful to check the switch's MAC table for a VLAN. If it doesn't show the router's MAC address then the VLAN config isn't working.

For completeness: you don't need to deactivate routing on the L3 switch since you can connect any number of routers to a subnet (at least while testing). Just make sure you don't use asymmetric routing (different gateways in different directions) or know what special handling that may require.

EDIT You can connect all relevant VLANs to the firewall/router directly or you can use an intermediate routing subnet between the L3 switch and the firewall. There's no "best practice" for this. If you do use an intermediate subnet, make sure your firewall learns about the subnets that it's not connected to ("behind" the L3 switch), either by setting static routes or a routing protocol like OSPF between the gateways.

In regard to where to route: I like routing internal, inter-VLAN communication on an L3 switch (because it's fast and doesn't have a session limit) and external traffic through the firewall. For that, you point the end nodes' default gateway towards their respective SVI and the L3 switch's default route towards the firewall/WAN router.

If need be, you can filter traffic on an L3 switch as well using ACLs, albeit only in a stateless fashion. If that doesn't match your security requirements you need to run everything through the firewall. Do make sure that the firewall's session capacity is sufficient for all your internal traffic! Routing everything on the firewall reduces your L3 switch to L2 functionality.

  • Thanks for the answer. I edited my question with the details you asked. But, if I set my FW GW as X.Y.Z.254 and my VLAN GW as X.Y.Z.253, am I forced to change the GW address of each computer on the subnet ?
    – rouilleart
    Jun 7, 2022 at 11:44
  • I've expanded my answer somewhat. There are many ways to do it and no single way is "best". Basically, you point your end nodes' default gateway to either the L3 switch or to the firewall, depending on what fits best your needs.
    – Zac67
    Jun 7, 2022 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.