Multiple VLANs behind single firewall segment?

jason.williams — Mon, 11 Mar 2019 22:24:52 GMT

Here is what I need to do. I need to create a firewalled segment that not only separates hosts from general population, but also from each other. The solitary confinement of firewalled segments.

I know that I could create a bunch of sub-interfaces, one for each host or group that needs to be isolated, but I'd really rather not have to do that if possible. 1) It could become a management nightmare between ACLs and sub-interfaces and 2) it's a waste of IP addresses.

Is there any way that I can create a bunch of separate VLANs behind the firewall and have them all terminate at the firewall, using a single firewall IP address for the gateway?

Kind of like this?

VLAN 1 - hosts 1.1.1.5 and 1.1.1.6
VLAN 2 - hosts 1.1.1.7	Firewall DMZ Interface - 1.1.1.1
VLAN 3 - hosts 1.1.1.8 and 1.1.1.9

This way, the hosts are isolated and can't talk to each other unless they're on the same VLAN.

So, 1) does this make sense? and 2) is it possible?

I'm working with an ASA 5510 running 8.2.4(4).

Thanks.

Jason

Multiple VLANs behind single firewall segment?

rizwanr74 — Mon, 06 Feb 2012 20:42:00 GMT

HI there,

Please read this thread at below link, it was very much similar implementation was done.

https://supportforums.cisco.com/message/3546019#3546019

Thanks

Rizwan Rafeek

topic Multiple VLANs behind single firewall segment? in Network Security

Multiple VLANs behind single firewall segment?

Multiple VLANs behind single firewall segment?