03-13-2025 06:02 PM
Hello
So I was being assisted and it was mentioned to turn my vlans interfaces into router interfaces but wanted to see if I could get more information on the differences.
FPR1010 (FDM) with 6 vlans and 6 Interfaces are in Switch mode assigned its own vlan. I also have 6 DHCP Servers assigned to the 6 gland; So, 6 Interfaces have their own vlan which has its own DHCP Server.
Whatever device I plug into whatever interface grabs its corresponding IP.
My question is, would there be any benefit to converting each of these SVI’s into L3 Routed interfaces?
At what point / scenario would I determine if I would use a vlan or Routed L3?
I know how to implement each, I am just struggling on when and why I would choose one over the other.
Solved! Go to Solution.
03-16-2025 03:47 PM
I would put all inside host in a single LAN. The firewall would have 2 routed interfaces - one inside and one outside.
I would NAT the hosts that need static NAT, for access from outside, into the 5 static WAN IP you gave from the ISP and keeping one WAN IP for general NAT/PAT for the other hosts on the LAN.
You don't have any real gain from separating LAN hosts into that many VLANS. This approach is used when the number of hosts on a given LAN is greater than 254. In this case you either configure a supernet (/22 for example would accommodate 1000 hosts on the LAN) on the interface or you configure secondary addresses in the LAN interface - none of these two workarounds are optimal because of the great number of broadcasts a large number of hosts generate - thus degrading communication performance on the LAN. This is why the design recommendation is to separate LANs in /24 subnets.
But in your case, you have a couple of host on your home LAN and you can put ALL your devices on one single LAN without facing any issues.
The DHCP server could run on the FPR or on the switch SG350XG or on any Linux or Windows VM you have in your environment.
HTH
03-13-2025 07:41 PM
"My question is, would there be any benefit to converting each of these SVI’s into L3 Routed interfaces?"
Yes.
"At what point / scenario would I determine if I would use a vlan or Routed L3?"
As you plan/design how you intend to use the L3 interface.
Basically, the "routed" interface suppresses some low level control traffic like DTP, and, to many, is logically more suitable for being the end point for a p2p connection or the gateway to another switch's VLAN. I.e. being used like a "real" (non L3 switch) router's interface.
BTW, years ago, I proposed using SVIs on stackable branch switches instead of routed ports when there was only a single uplink. Two ports would be defined for the uplink, each on a different member switch. If switch with uplink failed, uplink could be repatched into other stack member port without need to reconfigure.
03-13-2025 08:02 PM
Interesting.
I can not say exactly which method would indeed work for me. This is all "home" level implementation and I will even admit I probably am making it more complicated but for now, I am having fun.
Like I said, 6 WAN IP's, 6 DHCP Servers, 6 vlans and an Interface designated to each. Each end device will grab it's IP from it's respective DHCP Server.
I indeed want 'inside to inside' communication. Everything works well for me but like I said just not sure why I would choose one over the other.I can see what you are saying but I am still ...lost?
How I intend to use the L3 Interface? Well, again and this is over complicated, but for example;
vlan 2,3,4 are going to specific Servers and will utilize "static" LAN IP and vlan 7 is going to a wifi which will utilize DHCP.
I feel a lot of that is irrelevent but I am tryign to focus on "how do I intend to use the L3 interface'.
At this stage; whether SVI or L3, I want whatever is plugged into the Interface to grab an IP that is related to it's DHCP Server.. So still, unsure which I would choose.
03-14-2025 03:40 AM
Likely the reason choice appears so confusing is both, from a L3 perspective, are almost identical. The big difference is whether you want multiple VLAN ports directly "attached" (same device) to your L3 interface.
When L3 switches came onto the market, when one only previously had routers and hubs/switches, one way to understand SVIs was to think of a L3 switch as a L2 VLAN capable switch and a router in the same physical device, which could implement all the usually L2/L3 topologies.
Consider, pre L3 switch topologies:
1) Router <p2p> Router
2) Gateway Router <> L2 domain
3) 2+ Routers <> L2 domain
How might you use L3 switches routed ports vs. SVIs?
For #1, you could use either, but usually routed ports would be used.
For #2, you would need a SVI.
For #3, whatever L3 switches are hosting the L2, they would use SVIs, but those not hosting the L2, are like #1, they could use either but would likely use routed.
The usual practice, when you must use a SVI, it's used, but if you can use either, a routed port is used.
Again, a routed port, as a choice, avoids using some low level traffic, but perhaps more importantly, it makes clear it's a usage case where a SVI is NOT required.
The last may not seem important, but when you get a phone call 3 AM, and need to dive into a part of a large network you've never seen before, any "hints" about network topology are useful.
In my prior reply, my proposal about a special usage case using a SVI rather than a routed port wasn't accepted as it was too confusing, and it was unlikely to be needed. Laugh, however, 4 months later, we had a very small branch down for over 6 hours because it took that long to get a network engineer on site when a site user could have just repatched the uplink if it had been a SVI. The field engineer that dealt with the event told me, I now really understand why you proposed this. (Of course, this still wasn't done because it was an unusual topology [true, most branches had dual uplinks] and it's a rare failure situation [also true].)
03-14-2025 10:55 AM - edited 03-15-2025 06:08 PM
Bump
03-15-2025 06:13 PM
Hi
Indirect question but still related to SVI/Routed/vlan.
I was curious about your [anyones] thoughts on a configuration. What would the more legitimate realistic approach be in my scenario. I have 6 Static WAN IP’s and so what I did was make 6 vlans/networks. These networks are NAT’d to the WAN IP’s and then my 6 Interfaces are designated to each vlan/SVI.
Is this overkill and unpractical? Would the more professional approach be to have 1 Network and then NAT WAN to LAN on a need to be basis? Or is it also “common” to associate a WAN to LAN (Network).
My other question is, and this can be true to the prior question, would the FTD be the single device handling everything or would a Switch (SG350XG) be utilized to control vlan and so on?
Would I create 6 gland on FTD and TRUNK them to the Switcj or would I have nothing on the FTD and create static routes where to find these networks and create the networks in the Switch and let it control all (leaving NAT/ACL’s on FTD).
Just curious what another more realistic approach would be.
03-16-2025 04:53 AM
There's no right or wrong answer, it depends on what your overall setup looks like and what you're trying to accomplish.
With regards to the FTD1010, like many smaller firewalls it comes with a built-in switch, where two of the ports are PoE.
So if you think about a small setup, maybe just one network with 1 AP and 3 computers, then instead of adding an additional switch you can connect all of them just directly to the firewall and use the built-in switch (and PoE for the AP).
If your setup starts to become bigger and/or more complex, you're likely to have one or more switches, at which point you can start weighing the pro's & con's of having a SVI on the firewall vs having a routed interface/subinterface.
For example, if you have a switch (SG350XG?) and a FTD1010, and you have a few different networks, why would you spend 6 cables/ports between those devices when you could put everything on one physical interface with subinterface per vlan.
Sure, you'll be sharing the 1G bandwidth, but most of the time considering this type of devices I'm guessing that there isn't that bandwidth to go around anyway.
(I'm making a big assumption here, so I'll refer to my original point, "it depends")
Deciding where the L3 termination is (FTD or the L3 switch) is another discussion that's independent of if there's a trunk between the FTD and the switch or not.
And the biggest factor here is if you want/need segmentation and access-control between your networks.
03-16-2025 11:49 AM
I understand what you are saying.
I am just lost on which is best for me. There are many devices (mostly VM’s) that indeed utilize their own WAN IP (several email servers, web server and then domains etc). So the 6 WAN question is that yes I need them. The deeper question is how to implement;
Do I create 6 vlans, their own Networks and associate via NAT the WAN to LAN (Network) or do I have 1 Network and NAT WAN to LAN (IP) based on its needs.
Do I have , as it currently is, each Interface as Switch and being associated to its respective vlan/ Network / DHCP so each Interface hands out its Networks LAN IP address which associates to its respective WAN IP via NAT.
Do I lave the Interfaces Routed and then connect to a Switch for each Network.
I know these are absolute “what fits my needs” answers but still assume there is a standard way of doing things.
Do Interfaces in ROUTED Mode still utilize an IP (usually 192.168.1.1 (for example) and still utilize the DHCP Server associated with that Interface and then connect a switch (L2) and plug and play at that point.
Just seems like the SVI and ROUTED do the exact same thing but the SVI can cover several Interfaces whereas the Routed is hitting a specific endpoint be it a host or a Switch.
03-16-2025 03:47 PM
I would put all inside host in a single LAN. The firewall would have 2 routed interfaces - one inside and one outside.
I would NAT the hosts that need static NAT, for access from outside, into the 5 static WAN IP you gave from the ISP and keeping one WAN IP for general NAT/PAT for the other hosts on the LAN.
You don't have any real gain from separating LAN hosts into that many VLANS. This approach is used when the number of hosts on a given LAN is greater than 254. In this case you either configure a supernet (/22 for example would accommodate 1000 hosts on the LAN) on the interface or you configure secondary addresses in the LAN interface - none of these two workarounds are optimal because of the great number of broadcasts a large number of hosts generate - thus degrading communication performance on the LAN. This is why the design recommendation is to separate LANs in /24 subnets.
But in your case, you have a couple of host on your home LAN and you can put ALL your devices on one single LAN without facing any issues.
The DHCP server could run on the FPR or on the switch SG350XG or on any Linux or Windows VM you have in your environment.
HTH
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide