topic Re: implementing private VLANs on Firepower in Network Security

implementing private VLANs on Firepower

PiotrB — Thu, 30 Jun 2022 14:59:39 GMT

My department is looking for implementing private VLANs on Firepower 2000 and 4000 series.

Is this feature available or supported on FTD/FMC?

Thanks in advance for the reply.

Re: implementing private VLANs on Firepower

Rob Ingram — Thu, 30 Jun 2022 15:07:20 GMT

@PiotrB Private VLANs are a function of switches, not the firewalls.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-3/configuration_guide/vlan/b_173_vlan_9300_cg/configuring_private_vlans.html

You can segment networks (VLANs) behind the Firewall, but filtering traffic within the VLAN would not be routed via the Firewall.

Re: implementing private VLANs on Firepower

Marvin Rhoads — Thu, 30 Jun 2022 15:27:11 GMT

Adding to what @Rob Ingram correctly noted, even the firewall models that support onboard switching (like the Cisco Secure Firewall 1010) do not support private VLANs.

PVLAN is mostly a technology that has been abandoned in favor of other segmentation or microsegmentation techniques. I have seen them in use in production once in over 30 years of experience working with hundreds of customer networks.

Re: implementing private VLANs on Firepower

Wan_Whisperer — Sun, 10 Nov 2024 16:38:53 GMT

Marvin,

Can you go into a little more detail on the "segmentation or microsegmentation techniques" ?