topic Can the router force in Network Security

Router on a stick with Firewall solution (inter-vlan routing)

t.singletary — Tue, 12 Mar 2019 08:49:27 GMT

I want to do a inter-vlan routing solution with a firewall in the solution. what would the topology look like? The Firewall will need to be able to do trunking right?

Router

Firewall

Switch

Network devices

Sure, you can configure a

Rahul Govindan — Tue, 24 Jan 2017 00:01:02 GMT

Sure, you can configure a firewall on a stick by breaking a single interface into sub-interfaces, each having its own VLAN. The original physical interface acts as a trunk without the need to specify any config. The sub-interfaces behave as completely different interfaces logically although they use the same physical interface. On the core switch, it will ideally be trunk port for the link towards the ASA carrying the vlans that need to be protected.

A good example is given here:

http://www.petenetlive.com/KB/Article/0001085

Hi

Francesco Molino — Tue, 24 Jan 2017 00:07:19 GMT

You can do a trunk on the switch side and using sub interfaces on Cisco ASA (If it's Cisco). Others can do as well. This is for all ASA models except ASA 5505.

On ASA 5505, you can create trunk interface and using vlan interface (like a switch).

Thanks

PS: Please don't rate and mark as correct answer if this answered your question

Can the FW connect directly

t.singletary — Tue, 24 Jan 2017 00:24:43 GMT

Can the FW connect directly to the Router and the Router to Switch Trunk for inter- Vlan routing ?

Making the LAN DG the Switch to force traffic thru the switch.

I don't get you. Make a quick

Francesco Molino — Tue, 24 Jan 2017 00:41:00 GMT

I don't get you. Make a quick sketch to see what you're thinking please.

Can the router force

t.singletary — Tue, 24 Jan 2017 01:43:24 GMT

Can the router force all traffic to the FW ?

ISP

Serial0/0

Router> Ethernet 0/0 To <FireWall

Ethernet 0/1

(Trunking)

Switch

VLAN 10, 20 ,30

Yes it will works. Sub

Francesco Molino — Tue, 24 Jan 2017 01:47:28 GMT

Yes it will works. Sub interfaces will be created on ASA as explained before.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

That's not a good design.

Mohammed al Baqari — Tue, 24 Jan 2017 04:48:02 GMT

That's not a good design. Always place L2 device between Router and Firewall. In the future if you want to introduce a new redundant ASA, you will need to recable.

Re: That's not a good design.

LuvAggarwal61728 — Sat, 11 Jan 2020 16:13:14 GMT

how can you place a switch between router and firewall? how will the traffic flow from switch out to all the ports through the firewall? Firewall only has 1 or 2 ports to pass traffic.

Re: Hi

venus.grc — Sun, 14 Nov 2021 11:56:00 GMT

Hi. Is it possible to have router on a stick + l2 switch + firewall on a stick as i need additional subnets to be routed over the firewall? Is that possible. 2 router on a stick on a network?