@Seb Rupik wrote:
Hi Sub,
1) Yes, so long as each VLAN has a Layer3 interface (SVI) and the assigned subnet appears in the routing table as a 'connected' route then inter-VLAN communication will work.
2) Any combination of source/ destination will work.
3) How are the devices connected to your VLANs receving their IP addresses? Have you got a DHCP server running on the network? Is the SG300 going to be operating as a DHCP server for all VLANs?
4) Your default route is correct, and you should be able to ping 8.8.8.8 from the SG300. Providing you have configured each device to use their respective VLAN SVI as their default gateway, they should be able to reach 10.0.0.1 . You will need to add the following routes to the pfSense box so that it knows how to return internal traffic:
!
ip route 10.0.8.0 0.0.0.255 10.0.0.6
ip route 10.0.18.0 0.0.0.255 10.0.0.6
ip route 10.0.88.0 0.0.0.255 10.0.0.6
!
Also, the NAT ACL on the pfSense box will need to include the VLAN 8, 18 and 88 subnets.
5) An ACL can block IP protocol/ IP addresses/ services. What do you need to acheive. If you wanted to secure your VLANs, it would make more sense to trunk them to your pfSense box, route and apply ACLs there.
cheers,
Seb.
Seb,
Thanks. Maybe I should focus on making one thing work at a time. Let's say making internal VLAN 8, 18, 88 communicate to each other first and then move to VLAN to internet.
3.a) Currently I am using all static IP to check if it works then will consider moving to DHCP. It is ESX 6.5 environment (8 - VM network, 18 - vMotion, 88 - iSCSI & CIFS, default VLAN 1 = 10.0.0.x is for mgmt)
3.b) If moving to DHCP (VLAN 1 and VLAN 8 only, shoud I use pfSense or SG300? Does SG300 allow DHCP on two VLAN only? And where to configure DHCP in SG300?
3.c) As I am focusing on VLAN within SG300 first, I haven't setup VLAN interface on pfSense LAN side, does it prevent me from achiving internal VLAN commmunication within SG300?
