We currently have two different internet providers coming into our office (one is a backup), and each is going into separate switches. From the two different switches they are going up into both of our SonicWall NAS 4600 firewalls. I want to be able to eliminate the two small switches & setup one bigger switch with VLANs to do the job that the two smaller ones were doing. Attached is what it currently looks like, one internet provider is plugged into the Linksys switch & then out of there to the Primary & Secondary Firewall. The second internet provider into TrendNet, & out of there to the Primary & Secondary Firewalls. The firewalls routes everything for us, & does the DHCP. Any suggestions on how this can work?
You can simply create a VLAN for each ISP on the bigger switch.
On the ISP-facing switch ports, make sure you permit only that single, untagged VLAN, disable or configure appropriately RSTP/MSTP (BPDU filter, TCN guard), disable LLDP, CDP, etc. Do not configure any IP address.
Towards each firewall you can either use two dedicated access ports or (more elegantly) a single VLAN trunk. You could even run your internal VLAN on the same trunks but I prefer to use an extra link there.
For example, it could look like this:
- VLAN 4001 untagged on port 47 (ISP1)
- VLAN 4002 untagged on port 48 (ISP2)
- VLAN 4001 and 4002 tagged on port 45 (primary firewall)
- VLAN 4001 and 4002 tagged on port 46 (secondary firewall)
On the firewalls, you'd configure two subinterfaces (one each for VLANs 4001 and 4002) on the single uplink port, one for each ISP.
For a HPE/Aruba 2530 series switch (from comment) the VLAN/interface would look like something along
vlan 4001 name ISP1 vlan 4001 untagged 47 vlan 4001 tagged 45,46 vlan 4002 name ISP2 vlan 4002 untagged 48 vlan 4003 tagged 45,46 spanning-tree 47-48 bpdu-filter tcn-guard root-guard admin-edge-port
bpdu-filterdisables (rapid/multiple) spanning tree for that port
tcn-guardignores topology change notification on that port [*]
root-guardprevents any connect switch to become STP root bridge [*]
admin-edge-portskips the initial blocking state of a port on link up [*]
- the last three [*] items are gratuitous with
bpdu-filterbut don't hurt, just in case
If you're facing connectivity problems, run the usual checklist:
- do host MACs show up on the intended VLAN?
- can the hosts ping or at least ARP their default gateway?
- can the gateway ping/traceroute the destination?
- does the gateway permit the host packets onto the destination subnet?
- ... and back from the destination to the host?