topic FTDs in ASA with Inline Sets. in Network Security

Adding a layer2 firewall between VLANS with same subnet.

md09 — Tue, 12 Mar 2019 08:56:41 GMT

Hi,

I'm not a network engineer myself, but will try and communicate this best I can. Please bear with me.

I have servers on a subnet that I need to segment for security reasons. Currently they are all in a single VLAN. I'd like to complete this segmentation without readdressing. I would like to have a firewall between these segments. Everything is patched into a 4500 switch running in layer 3 mode.

My idea;

Create new VLANS for the servers to be segmented off, but share the subnet.
Do not allow these VLANs to access each other within the 4500
Present a port on the 4500 for each VLAN and connect this to the firewall.
Run the firewall in layer2/transparent/bridging mode to connect the VLANS.
Reconfigure the ports the servers are patched to reflect the VLAN I wish them to be in.
Add rules on firewall the block unwanted traffic between the VLANS.

I hope that makes sense?

Is what I am proposing possible?

Any advice or suggestions welcomed.

Many thanks

Mark.

Each server in own vlan (with

FrOg Lee — Thu, 16 Feb 2017 14:13:35 GMT

Each server in own vlan (with /30 mask as a example)

and depending on the version of the ASA software to configure the access rights between them (through access lists or NAT)

Thanks for reply FrOg.

md09 — Thu, 16 Feb 2017 15:33:21 GMT

Thanks for reply FrOg.

So essentially you are saying what I suggest will work? I don't want to segment individual servers, but groups of them.

FTDs in ASA with Inline Sets.

Claudiu Cismaru — Thu, 16 Feb 2017 21:24:47 GMT

FTDs in ASA with Inline Sets. Acts like a bump on the wire, without having to change anything in your current addressing, only cabling.

Or you could do with ASA OS and Firepower in transparent mode. It's not as "invisible" as the FTD with inline mode, but it could do the trick.

Or you can use other products, like 8000 series, 7000 series, which you can be used inline and can do more hardware level things.