topic Re: Query in Network Security https://community.cisco.com/t5/network-security/query/m-p/1093138#M894992 <HTML><HEAD></HEAD><BODY><P>Thanks!!</P></BODY></HTML> Thu, 16 Oct 2008 18:47:44 GMT ray_stone 2008-10-16T18:47:44Z Query https://community.cisco.com/t5/network-security/query/m-p/1093136#M894989 <P>Hi,If i create V-lans on FW and same V-lans I configure on switch. Which one wud be great option as per security concerned. Switch or FW???? Thanks.</P> Mon, 11 Mar 2019 13:58:24 GMT https://community.cisco.com/t5/network-security/query/m-p/1093136#M894989 ray_stone 2019-03-11T13:58:24Z Re: Query https://community.cisco.com/t5/network-security/query/m-p/1093137#M894991 <HTML><HEAD></HEAD><BODY><P>Its better to have VLANs configured on FW</P><P></P><P>a)FW treats VLAN on itself just like another logical interface</P><P></P><P>b)Will not allow traffic to flow across this VLAN/Interface unless you have ACLs and translation in place, also only traffic for which there is a valid connection would be allowed to this VLAN</P><P></P><P>c)Switch does not have statefull nature/security , which means if there is Inter-VLAN routing enabled on this switch the packet would start flowing to/from this "VLAN"</P><P>unless you have VACLs blocking this traffic,which again is only L3 security but no statefullness</P><P></P><P></P><P></P></BODY></HTML> Thu, 16 Oct 2008 17:45:41 GMT https://community.cisco.com/t5/network-security/query/m-p/1093137#M894991 abinjola 2008-10-16T17:45:41Z Re: Query https://community.cisco.com/t5/network-security/query/m-p/1093138#M894992 <HTML><HEAD></HEAD><BODY><P>Thanks!!</P></BODY></HTML> Thu, 16 Oct 2008 18:47:44 GMT https://community.cisco.com/t5/network-security/query/m-p/1093138#M894992 ray_stone 2008-10-16T18:47:44Z