Where should my default gateway be?

[Tom101]

Hello Cisco Community,

I'm new to networking. Where should my default gateway be on this topology for VLAN 10? I would like 192.168.1.1 to be the default gateway. 

The firewall is my edge device. I'm guessing it's on the L3 switch because I don't believe you can add VLAN on the firewall for internal network devices? 

Attached is a image. 

[balaji.bandi · Accepted solution]

Best is add interface vlan 10 in Muliti latyer switch.

[Tom101]

Thank you, with the default gateway? Correct?

[balaji.bandi]

below switches act as layer 2 then default gateway.

[Tom101]

Ok, thank you. 

[Joseph W. Doherty]

"I would like 192.168.2.1 to be the default gateway."

Default gateway?  You're planning on have multiple gateways for VLAN 10?

BTW, network gateways should be within the same network as hosts are using.  What network is VLAN 10 using, as it appears it might be using 192.168.1.0/24?

"I'm guessing it's on the L3 switch because I don't believe you can add VLAN on the firewall for internal network devices?"

"it's" being the gateway?

". . . I don't believe you can add VLAN on the firewall for internal network devices?"  Possibly true - depends on the FW.  Assuming you could host the gateway on the FW, if you have internal traffic between VLANs/networks on you LAN, having the gateways on the switch would may offer more capacity/performance rather than routing such traffic on the FW, is also "unloads" the FW from needing to deal in the inter VLAN traffic.  However, if all/most traffic is to/from outside, using FW for gateway(s) probably makes little difference (beyond perhaps not needing a L3 switch).

[Tom101]

Opps, that is my mistake. I meant the default gateway to be 192.168.1.1. 

Yes, "it's" the gateway. 

Most of the network will be going to/from the outside. I believe the 5506 firewall can't add vlans. I could be wrong though. 

[Joseph W. Doherty]

BTW, hosts, to my knowledge, don't have a "default" gateway, you define a gateway for them.

"Most of the network will be going to/from the outside."

If that's the case, from a performance standpoint, defining gateways on your L3 switch matters little (although, might be a bit easier to maintain routing on a L3 switch).

"I believe the 5506 firewall can't add vlans."

I don't know either (but reading post like:https://community.cisco.com/t5/switching/asa-5505-to-5506-x-vlans/td-p/2884526 might indicate it's possible [via some form of subinterfaces - as might be done on a Cisco router?), but if FW cannot, then yes, you'll want to define them on your L3 switch.