Cisco FPR-2110 as router on a stick

[harmitin]

Hi, I want to know, can we use FPR-2110 firewall as router on stick?

[Rob Ingram · Accepted solution]

@harmitin yes you can, you create a subinterface on the FPR2110 for each VLAN to be routed.

[harmitin]

HI Rob, Thanks for your reply. I have below scenario where we are using core switch with no routing functionality, only to create VLAN's. Routing between different VLAN should happen via firewall and come back to core switch on the same physical interface as there is only one physical link between firewall and core switch. We have requirement from client that routing should happen on firewall only. At the same time, I wanted to allow policy based forward to send the traffic from core switch network to DMZ switch network via firewall. is this design is correct?

[Rob Ingram]

@harmitin this seems overly complex (PBR) for a simple design. Why not just create a static route on the core switch for the Voice recording server network, via the FPR2110's inside interface IP address.

[harmitin]

Hi Rob, Its is client requirement and as communication between different between VLAN or network should happen through firewall. We will using DMZ switch for windows update server and voice recording server as voice recorder will get traffic from all VLAN in one direction only that is communication from all VLAN's to voice recorder only not in vice versa.

[Rob Ingram]

@harmitin sure I understand, my suggestion was to route the traffic via the FW.

The other option would be to configure the FW in transparent mode.

[harmitin]

HI Rob, Thanks for your reply. So our design is correct. we shall route the traffic via firewall from Vlan x to vlan y towards core switch on the same physical interface and at the same time we will allow PBR to forward the traffic from core switch to DMZ switch network.

[MHM Cisco World]

Yes since the FW is L3 device like Router and support subinerface, you can config it as router on stick. 
only make sure you config link to SW as trunk from SW side. 

[harmitin]

Hi, Thanks for your response. I have below scenario where we are using core switch with no routing functionality, only to create VLAN's. Routing between different VLAN should happen via firewall and come back to core switch on the same physical interface as there is only one physical link between firewall and core switch. We have requirement from client that routing should happen on firewall only. At the same time, I wanted to allow policy based forward to send the traffic from core switch network to DMZ switch network via firewall. is this design correct?

[MHM Cisco World · Accepted solution]

NO issue, 
Core with VLAN x,y no ip routing 
FW have subinterface for VLAN x,y meaning the FW is GW for all client 
any traffic between x,y will pass through FW 
DMZ SW have vlan Z no ip routing 
FW have subinterface for VLAN z meaning the FW is GW for all client 
the traffic will pass from x,y to z through FW 
so no problem 

[harmitin]

Thank you