Firewall for restricting access between VLAN

[Tommy Svensson]

Hi.

I am about to set up a network with about 20+ different VLANs and they are suppose to just access the Internet and not eachother, is this possible with a zone-based firewall? To put all the interfaces belonging to VLANs in one zone allowing them to just access the Internet and not eachother.

My questions are:

Is it possible and what do i need to configure for this to work?

Regards Tommy Svensson

[Jennifer Halim · Accepted solution]

Yes, you can use Zone Based FW to restrict access, however, you do not want to put them into the same zone because same zone means they will be able to access each other.

If you don't want to have access between each zone, you will place them in different zones, and just create policy and zone pair for each of the zone towards the outside.

Here is configuration guide on ZBFW:

http://www.cisco.com/en/US/products/ps6441/products_feature_guide09186a008060f6dd.html

But in general, here is what you have to configure:

1) Configure the access-list to match what you want to allow

2) Create class-map, to match on the access-list created on step1

3) Create policy-map, with the action of inspect for the class created on step2

4) Create zone member

5) Create zone-pair, with source zone being internal vlan, and destination zone being the outside/internet, and apply the policy-map to the zone-pair

6) Lastly place the zone under the vlan interface

Hope that helps.

[Tommy Svensson]

Im using a Cisco 2911 router and want to restrict access between VLANs, is zone based firewall the way to go or am i missing something?

Regards Tommy Svensson