topic Firewall for restricting access between VLAN in Network Security

Firewall for restricting access between VLAN

Tommy Svensson — Mon, 11 Mar 2019 19:56:36 GMT

Hi.

I am about to set up a network with about 20+ different VLANs and they are suppose to just access the Internet and not eachother, is this possible with a zone-based firewall? To put all the interfaces belonging to VLANs in one zone allowing them to just access the Internet and not eachother.

My questions are:

Is it possible and what do i need to configure for this to work?

Regards Tommy Svensson

Re: Firewall for restricting access between VLAN

Jennifer Halim — Fri, 25 Feb 2011 08:30:00 GMT

Yes, you can use Zone Based FW to restrict access, however, you do not want to put them into the same zone because same zone means they will be able to access each other.

If you don't want to have access between each zone, you will place them in different zones, and just create policy and zone pair for each of the zone towards the outside.

Here is configuration guide on ZBFW:

http://www.cisco.com/en/US/products/ps6441/products_feature_guide09186a008060f6dd.html

But in general, here is what you have to configure:

1) Configure the access-list to match what you want to allow

2) Create class-map, to match on the access-list created on step1

3) Create policy-map, with the action of inspect for the class created on step2

4) Create zone member

5) Create zone-pair, with source zone being internal vlan, and destination zone being the outside/internet, and apply the policy-map to the zone-pair

6) Lastly place the zone under the vlan interface

Hope that helps.

Re: Firewall for restricting access between VLAN

Tommy Svensson — Thu, 03 Mar 2011 11:58:59 GMT

Im using a Cisco 2911 router and want to restrict access between VLANs, is zone based firewall the way to go or am i missing something?

Regards Tommy Svensson