We currently have two different internet providers coming into our office (one is a backup), and each is going into separate switches. From the two different switches they are going up into both of our SonicWall NAS 4600 firewalls. I want to be able to eliminate the two small switches & setup one bigger switch with VLANs to do the job that the two smaller ones were doing. Attached is what it currently looks like, one internet provider is plugged into the Linksys switch & then out of there to the Primary & Secondary Firewall. The second internet provider into TrendNet, & out of there to the Primary & Secondary Firewalls. The firewalls routes everything for us, & does the DHCP. Any suggestions on how this can work? 
-
Are you asking how to configure the switch? What kind is it?– Ron TrunkOct 5, 2022 at 15:11
-
Why not simply plug the ISP directly into the firewall(s)? Why do you want to insert a single point of failure, a single switch, in the topology?– Ronnie RoystonOct 7, 2022 at 20:48
-
@RonnieRoyston As it seems, there's just a single handover port for each ISP and they'd want to connect both to each firewall.– Zac67 ♦Oct 12, 2022 at 19:45
-
@Zac67 so in that case I would argue that they are adding unnecessary complexity to the design/architecture. Statistically speaking, and assuming the firewalls operate independently vs as a single node, the idea that both a firewall and its connected ISP would fail concurrently is unrealistic. Keep it simple for maximum uptime. That's my 2 cents.– Ronnie RoystonOct 13, 2022 at 20:13
-
@RonnieRoyston If the ISP router fails then it's irrelevant whether their backbone is still working. Essentially, there are two WAN connections, each with a single handover port, and the OP wants to create a redundant uplink using redundant firewalls.– Zac67 ♦Oct 14, 2022 at 12:58
|
Show 6 more comments
1 Answer
You can simply create a VLAN for each ISP on the bigger switch.
On the ISP-facing switch ports, make sure you permit only that single, untagged VLAN, disable or configure appropriately RSTP/MSTP (BPDU filter, TCN guard), disable LLDP, CDP, etc. Do not configure any IP address.
Towards each firewall you can either use two dedicated access ports or (more elegantly) a single VLAN trunk. You could even run your internal VLAN on the same trunks but I prefer to use an extra link there.
For example, it could look like this:
- VLAN 4001 untagged on port 47 (ISP1)
- VLAN 4002 untagged on port 48 (ISP2)
- VLAN 4001 and 4002 tagged on port 45 (primary firewall)
- VLAN 4001 and 4002 tagged on port 46 (secondary firewall)
On the firewalls, you'd configure two subinterfaces (one each for VLANs 4001 and 4002) on the single uplink port, one for each ISP.
For a HPE/Aruba 2530 series switch (from comment) the VLAN/interface would look like something along
vlan 4001 name ISP1
vlan 4001 untagged 47
vlan 4001 tagged 45,46
vlan 4002 name ISP2
vlan 4002 untagged 48
vlan 4003 tagged 45,46
spanning-tree 47-48 bpdu-filter tcn-guard root-guard admin-edge-port
bpdu-filterdisables (rapid/multiple) spanning tree for that porttcn-guardignores topology change notification on that port [*]root-guardprevents any connect switch to become STP root bridge [*]admin-edge-portskips the initial blocking state of a port on link up [*]- the last three [*] items are gratuitous with
bpdu-filterbut don't hurt, just in case
If you're facing connectivity problems, run the usual checklist:
- do host MACs show up on the intended VLAN?
- can the hosts ping or at least ARP their default gateway?
- can the gateway ping/traceroute the destination?
- does the gateway permit the host packets onto the destination subnet?
- ... and back from the destination to the host?
-
-
-
Hi Zac67, Since I am new to doing this, I have a question about the tagged ports. Since we are tagging both ISP1 & 2 on ports 45 & 46 will that cause in conflict? Is there anyway to make the remaining ports work, so we can plug items into it & get out on the network (we would probably have to uplink from another switch into one of the open ports)?– ChadOct 12, 2022 at 19:18
-
Using VLAN tags is all about connecting multiple VLANs on a single interface, called a trunk port in Cisco land. You can run as many VLANs across a trunk as you want and your switches support - just make sure you configure both sides in the same way. You can connect any device to a VLAN by assigning that VLAN as untagged to the device's port. If that device support VLANs you can use a trunk port with multiple tagged VLANs.– Zac67 ♦Oct 12, 2022 at 19:42
-
Hi Zac67, Since Linksys switch as two ports out (one going to each firewall) & the TrendNet has the same thing, wouldn't we need a total of 4 tagged ports?– ChadOct 18, 2022 at 21:27